RUSTSEC-2021-0158 GHSA-f2pc-rwv3-69mv

XSS in ammonia via SVG `animateMotion`, `animateTransform`, and/or `animateColor` tags

Not rated yet crates.io

Severity: Not rated yet; No source has published a CVSS score yet
Exploit chance (EPSS): —; No score published
Known exploited: No; Not in CISA's catalog
Weakness: —; Not classified
Fix: 4.2.3; Upgrade ammonia to this version or later

Description

The neutralization that ammonia applied to animate and set was not applied to other forms of SVG animation, which can be used for XSS.

The following SVG will produce a link with a javascript scheme. If the user clicks this link, they will run it.

<svg xmlns="http://www.w3.org/2000/svg">
  <a>
    <animateMotion attributeName="href" to="javascript:alert('SET_XSS')"></animateMotion>
    <text y="30">Click set</text>
  </a>
</svg>

Ammonia did not apply attribute filters based on attributeName, so the contents of the to, from, and values tags were not sanitized as URLs.

Applications that do not explicitly allow any of these tags should not be affected, since none are allowed by default.

This vulnerability was reported by ucsurf.

Affected versions

crates.io

Package	Vulnerable	Fixed in
ammonia	`>= 0.0.0-0, < 4.1.7` `>= 4.2.0, < 4.2.3`	`4.1.7` `4.2.3`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

ammonia crates.io → `4.2.3`

cargo

cargo update -p ammonia --precise 4.2.3

References

Advisories

rustsec.org/advisories/RUSTSEC-2021-0158.html

Packages

crates.io/crates/ammonia

Timeline

Oct 10, 2021 Published
Oct 13, 2026 Last updated by the source

Advisory	Severity	Why it's related
RUSTSEC-2026-0373 Missing case-insensitive matching for CSS url function	Not rated yet	Also affects ammonia
GHSA-m6mh-2hw2-555x Ammonia: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')	Medium	Also affects ammonia
GHSA-9jh8-v38h-cvhr ammonia: mXSS via MathML `annotation-xml` encoding strip	Medium	Also affects ammonia
GHSA-mm7x-qfjj-5g2c Ammonia incorrectly handles embedded SVG and MathML leading to mutation XSS after removal	Low	Also affects ammonia
GHSA-p2g9-94wh-65c2 Space bug in `clean_text`	Medium	Also affects ammonia
RUSTSEC-2021-0157 Incorrect escaping for `url("")` functions in CSS style attributes	Not rated yet	Also affects ammonia
GHSA-5325-xw5m-phm3 Cross-site Scripting in ammonia	Medium	Also affects ammonia
GHSA-5hp8-35wj-m525 Uncontrolled recursion in ammonia	High	Also affects ammonia

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor