ammonia (crates.io)
Advisories
22
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 4.2.4 or later clears every advisory below that has a fix.
Upgrade commands
cargo
cargo update -p ammonia --precise 4.2.4Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| RUSTSEC-2026-0373 Missing case-insensitive matching for CSS url function |
Not rated yet | >= 0.0.0-0, < 4.1.8>= 4.2.0, < 4.2.4 | 4.1.84.2.4 |
| GHSA-m6mh-2hw2-555x Ammonia: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
Medium EPSS 0.27% |
>= 4.0.0, < 4.0.3 | 4.0.3 |
| GHSA-m6mh-2hw2-555x Ammonia: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
Medium EPSS 0.27% |
>= 4.1.2, < 4.1.4 | 4.1.4 |
| GHSA-m6mh-2hw2-555x Ammonia: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
Medium EPSS 0.27% |
>= 0.0.0-0, < 3.3.3>= 4.0.0, < 4.0.3>= 4.1.0, < 4.1.4 | 3.3.34.0.34.1.4 |
| GHSA-m6mh-2hw2-555x Ammonia: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
Medium EPSS 0.27% |
< 3.3.3 | 3.3.3 |
| GHSA-9jh8-v38h-cvhr ammonia: mXSS via MathML `annotation-xml` encoding strip |
Medium EPSS 0.56% |
>= 4.0.0, < 4.0.2 | 4.0.2 |
| GHSA-9jh8-v38h-cvhr ammonia: mXSS via MathML `annotation-xml` encoding strip |
Medium EPSS 0.56% |
>= 4.1.0, < 4.1.3 | 4.1.3 |
| GHSA-9jh8-v38h-cvhr ammonia: mXSS via MathML `annotation-xml` encoding strip |
Medium EPSS 0.56% |
>= 0.0.0-0, < 3.3.2>= 4.0.0, < 4.0.2>= 4.1.0, < 4.1.3 | 3.3.24.0.24.1.3 |
| GHSA-9jh8-v38h-cvhr ammonia: mXSS via MathML `annotation-xml` encoding strip |
Medium EPSS 0.56% |
< 3.3.2 | 3.3.2 |
| GHSA-mm7x-qfjj-5g2c Ammonia incorrectly handles embedded SVG and MathML leading to mutation XSS after removal |
Low | < 3.3.1 | 3.3.1 |
| GHSA-mm7x-qfjj-5g2c Ammonia incorrectly handles embedded SVG and MathML leading to mutation XSS after removal |
Low | >= 0.0.0-0, < 3.3.1>= 4.0.0, < 4.0.1>= 4.1.0, < 4.1.2 | 3.3.14.0.14.1.2 |
| GHSA-mm7x-qfjj-5g2c Ammonia incorrectly handles embedded SVG and MathML leading to mutation XSS after removal |
Low | >= 4.1.0, < 4.1.2 | 4.1.2 |
| GHSA-mm7x-qfjj-5g2c Ammonia incorrectly handles embedded SVG and MathML leading to mutation XSS after removal |
Low | >= 4.0.0, < 4.0.1 | 4.0.1 |
| GHSA-p2g9-94wh-65c2 Space bug in `clean_text` |
Medium | >= 3.0.0, < 3.1.3 | 3.1.3 |
| GHSA-p2g9-94wh-65c2 Space bug in `clean_text` |
Medium | >= 3.0.0, < 3.1.3 | 3.1.3 |
| RUSTSEC-2021-0157 Incorrect escaping for `url("")` functions in CSS style attributes |
Not rated yet | >= 0.0.0-0, < 4.1.7>= 4.2.0, < 4.2.3 | 4.1.74.2.3 |
| RUSTSEC-2021-0158 XSS in ammonia via SVG `animateMotion`, `animateTransform`, and/or `animateColor` tags |
Not rated yet | >= 0.0.0-0, < 4.1.7>= 4.2.0, < 4.2.3 | 4.1.74.2.3 |
| GHSA-5325-xw5m-phm3 Cross-site Scripting in ammonia |
Medium EPSS 0.70% |
>= 3.0.0, < 3.1.0 | 3.1.0 |
| GHSA-5325-xw5m-phm3 Cross-site Scripting in ammonia |
Medium EPSS 0.70% |
>= 0.0.0-0, < 2.1.3>= 3.0.0, < 3.1.0 | 2.1.33.1.0 |
| GHSA-5325-xw5m-phm3 Cross-site Scripting in ammonia |
Medium EPSS 0.70% |
< 2.1.3 | 2.1.3 |
| GHSA-5hp8-35wj-m525 Uncontrolled recursion in ammonia |
High EPSS 1.41% |
< 2.1.0 | 2.1.0 |
| GHSA-5hp8-35wj-m525 Uncontrolled recursion in ammonia |
High EPSS 1.41% |
>= 0.0.0-0, < 2.1.0 | 2.1.0 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor