Vulnerability-Lookup

CVE-2026-102342 (GCVE-0-2026-102342)

Vulnerability from cvelistv5 – Published: 2026-10-13 14:28 – Updated: 2026-10-13 20:23

Title

ammonia allows stored XSS through unsanitized SVG animate and set attributes

Summary

ammonia is a Rust library for repairing and securing untrusted HTML. Prior to 3.3.3, 4.0.3, and 4.1.4, applications that allow the SVG animate or set elements can retain an animation whose attributeName targets href and whose value uses the javascript scheme. The sanitized SVG can therefore create a script-bearing link, and a user who clicks the link can execute attacker-controlled script in the application's origin, enabling stored cross-site scripting. This issue is fixed in versions 3.3.3, 4.0.3, and 4.1.4.

Severity

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-13 20:13 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7771 records in the last 180 days details

References

10 references

URL	Tags
https://github.com/rust-ammonia/ammonia/security/…	x_refsource_CONFIRM
https://github.com/rust-ammonia/ammonia/pull/250	x_refsource_MISC
https://github.com/rust-ammonia/ammonia/pull/251	x_refsource_MISC
https://github.com/rust-ammonia/ammonia/pull/252	x_refsource_MISC
https://github.com/rust-ammonia/ammonia/commit/93…	x_refsource_MISC
https://github.com/rust-ammonia/ammonia/commit/9e…	x_refsource_MISC
https://github.com/rust-ammonia/ammonia/commit/d2…	x_refsource_MISC
https://github.com/rust-ammonia/ammonia/releases/…	x_refsource_MISC
https://github.com/rust-ammonia/ammonia/releases/…	x_refsource_MISC
https://github.com/rust-ammonia/ammonia/releases/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
rust-ammonia	ammonia	Affected: < 3.3.3 Affected: >= 4.0.0, < 4.0.3 Affected: >= 4.1.2, < 4.1.4	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-102342",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-13T20:13:15.972756Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-13T20:23:10.660Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "ammonia",
          "vendor": "rust-ammonia",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.3.3"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.0.0, \u003c 4.0.3"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.1.2, \u003c 4.1.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "ammonia is a Rust library for repairing and securing untrusted HTML. Prior to 3.3.3, 4.0.3, and 4.1.4, applications that allow the SVG animate or set elements can retain an animation whose attributeName targets href and whose value uses the javascript scheme. The sanitized SVG can therefore create a script-bearing link, and a user who clicks the link can execute attacker-controlled script in the application\u0027s origin, enabling stored cross-site scripting. This issue is fixed in versions 3.3.3, 4.0.3, and 4.1.4."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T14:28:50.011Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/rust-ammonia/ammonia/security/advisories/GHSA-m6mh-2hw2-555x",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/rust-ammonia/ammonia/security/advisories/GHSA-m6mh-2hw2-555x"
        },
        {
          "name": "https://github.com/rust-ammonia/ammonia/pull/250",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rust-ammonia/ammonia/pull/250"
        },
        {
          "name": "https://github.com/rust-ammonia/ammonia/pull/251",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rust-ammonia/ammonia/pull/251"
        },
        {
          "name": "https://github.com/rust-ammonia/ammonia/pull/252",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rust-ammonia/ammonia/pull/252"
        },
        {
          "name": "https://github.com/rust-ammonia/ammonia/commit/9394bd81179e756cb911314deabd943f1a9c8989",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rust-ammonia/ammonia/commit/9394bd81179e756cb911314deabd943f1a9c8989"
        },
        {
          "name": "https://github.com/rust-ammonia/ammonia/commit/9e3335e2dd8ab07346ff7997f20662a3da4023f6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rust-ammonia/ammonia/commit/9e3335e2dd8ab07346ff7997f20662a3da4023f6"
        },
        {
          "name": "https://github.com/rust-ammonia/ammonia/commit/d2ae1547f478bd84d158bc5e57f5d31437dc4d8d",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rust-ammonia/ammonia/commit/d2ae1547f478bd84d158bc5e57f5d31437dc4d8d"
        },
        {
          "name": "https://github.com/rust-ammonia/ammonia/releases/tag/v3.3.3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rust-ammonia/ammonia/releases/tag/v3.3.3"
        },
        {
          "name": "https://github.com/rust-ammonia/ammonia/releases/tag/v4.0.3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rust-ammonia/ammonia/releases/tag/v4.0.3"
        },
        {
          "name": "https://github.com/rust-ammonia/ammonia/releases/tag/v4.1.4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rust-ammonia/ammonia/releases/tag/v4.1.4"
        }
      ],
      "source": {
        "advisory": "GHSA-m6mh-2hw2-555x",
        "discovery": "UNKNOWN"
      },
      "title": "ammonia allows stored XSS through unsanitized SVG animate and set attributes"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-102342",
    "datePublished": "2026-10-13T14:28:50.011Z",
    "dateReserved": "2026-09-28T22:38:42.254Z",
    "dateUpdated": "2026-10-13T20:23:10.660Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-102342",
      "date": "2026-10-16",
      "epss": "0.00355",
      "percentile": "0.2762"
    },
    "microsoft_vex": {
      "current_release_date": "2026-10-16T01:52:08.000Z",
      "cve": "CVE-2026-102342",
      "id": "msrc_CVE-2026-102342",
      "initial_release_date": "2026-10-15T01:11:11.000Z",
      "product_status:known_not_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "ammonia allows stored XSS through unsanitized SVG animate and set attributes",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-102342.json",
      "version": "2"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "ammonia",
                "vendor": "rust-ammonia",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 3.3.3"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 4.0.0, \u003c 4.0.3"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 4.1.2, \u003c 4.1.4"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "ammonia is a Rust library for repairing and securing untrusted HTML. Prior to 3.3.3, 4.0.3, and 4.1.4, applications that allow the SVG animate or set elements can retain an animation whose attributeName targets href and whose value uses the javascript scheme. The sanitized SVG can therefore create a script-bearing link, and a user who clicks the link can execute attacker-controlled script in the application\u0027s origin, enabling stored cross-site scripting. This issue is fixed in versions 3.3.3, 4.0.3, and 4.1.4."
          }
        ],
        "id": "CVE-2026-102342",
        "lastModified": "2026-10-16T20:04:29.760",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 5.4,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.3,
              "impactScore": 2.7,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-102342",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-13T20:13:15.972756Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-10-13T15:17:30.177",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/rust-ammonia/ammonia/commit/9394bd81179e756cb911314deabd943f1a9c8989"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/rust-ammonia/ammonia/commit/9e3335e2dd8ab07346ff7997f20662a3da4023f6"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/rust-ammonia/ammonia/commit/d2ae1547f478bd84d158bc5e57f5d31437dc4d8d"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/rust-ammonia/ammonia/pull/250"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/rust-ammonia/ammonia/pull/251"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/rust-ammonia/ammonia/pull/252"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/rust-ammonia/ammonia/releases/tag/v3.3.3"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/rust-ammonia/ammonia/releases/tag/v4.0.3"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/rust-ammonia/ammonia/releases/tag/v4.1.4"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/rust-ammonia/ammonia/security/advisories/GHSA-m6mh-2hw2-555x"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-79"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-10-15T21:14:59+00:00",
      "cve": "CVE-2026-102342",
      "id": "CVE-2026-102342",
      "initial_release_date": "2026-10-13T14:28:50.011000+00:00",
      "product_status:known_affected": "59",
      "product_status:known_not_affected": "9",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "ammonia: ammonia: Stored cross-site scripting via SVG animation elements",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-102342.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-102342",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-10-13T20:13:15.972756Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-10-13T20:13:17.247Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "ammonia",
              "vendor": "rust-ammonia",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 3.3.3"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 4.0.0, \u003c 4.0.3"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 4.1.2, \u003c 4.1.4"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "ammonia is a Rust library for repairing and securing untrusted HTML. Prior to 3.3.3, 4.0.3, and 4.1.4, applications that allow the SVG animate or set elements can retain an animation whose attributeName targets href and whose value uses the javascript scheme. The sanitized SVG can therefore create a script-bearing link, and a user who clicks the link can execute attacker-controlled script in the application\u0027s origin, enabling stored cross-site scripting. This issue is fixed in versions 3.3.3, 4.0.3, and 4.1.4."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 5.4,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-79",
                  "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-10-13T14:28:50.011Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/rust-ammonia/ammonia/security/advisories/GHSA-m6mh-2hw2-555x",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/rust-ammonia/ammonia/security/advisories/GHSA-m6mh-2hw2-555x"
            },
            {
              "name": "https://github.com/rust-ammonia/ammonia/pull/250",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/rust-ammonia/ammonia/pull/250"
            },
            {
              "name": "https://github.com/rust-ammonia/ammonia/pull/251",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/rust-ammonia/ammonia/pull/251"
            },
            {
              "name": "https://github.com/rust-ammonia/ammonia/pull/252",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/rust-ammonia/ammonia/pull/252"
            },
            {
              "name": "https://github.com/rust-ammonia/ammonia/commit/9394bd81179e756cb911314deabd943f1a9c8989",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/rust-ammonia/ammonia/commit/9394bd81179e756cb911314deabd943f1a9c8989"
            },
            {
              "name": "https://github.com/rust-ammonia/ammonia/commit/9e3335e2dd8ab07346ff7997f20662a3da4023f6",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/rust-ammonia/ammonia/commit/9e3335e2dd8ab07346ff7997f20662a3da4023f6"
            },
            {
              "name": "https://github.com/rust-ammonia/ammonia/commit/d2ae1547f478bd84d158bc5e57f5d31437dc4d8d",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/rust-ammonia/ammonia/commit/d2ae1547f478bd84d158bc5e57f5d31437dc4d8d"
            },
            {
              "name": "https://github.com/rust-ammonia/ammonia/releases/tag/v3.3.3",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/rust-ammonia/ammonia/releases/tag/v3.3.3"
            },
            {
              "name": "https://github.com/rust-ammonia/ammonia/releases/tag/v4.0.3",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/rust-ammonia/ammonia/releases/tag/v4.0.3"
            },
            {
              "name": "https://github.com/rust-ammonia/ammonia/releases/tag/v4.1.4",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/rust-ammonia/ammonia/releases/tag/v4.1.4"
            }
          ],
          "source": {
            "advisory": "GHSA-m6mh-2hw2-555x",
            "discovery": "UNKNOWN"
          },
          "title": "ammonia allows stored XSS through unsanitized SVG animate and set attributes"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-102342",
        "datePublished": "2026-10-13T14:28:50.011Z",
        "dateReserved": "2026-09-28T22:38:42.254Z",
        "dateUpdated": "2026-10-13T20:23:10.660Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-102342

Vulnerability from fkie_nvd - Published: 2026-10-13 15:17 - Updated: 2026-10-16 20:04

Severity

5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/rust-ammonia/ammonia/commit/9394bd81179e756cb911314deabd943f1a9c8989
	security-advisories@github.com	https://github.com/rust-ammonia/ammonia/commit/9e3335e2dd8ab07346ff7997f20662a3da4023f6
	security-advisories@github.com	https://github.com/rust-ammonia/ammonia/commit/d2ae1547f478bd84d158bc5e57f5d31437dc4d8d
	security-advisories@github.com	https://github.com/rust-ammonia/ammonia/pull/250
	security-advisories@github.com	https://github.com/rust-ammonia/ammonia/pull/251
	security-advisories@github.com	https://github.com/rust-ammonia/ammonia/pull/252
	security-advisories@github.com	https://github.com/rust-ammonia/ammonia/releases/tag/v3.3.3
	security-advisories@github.com	https://github.com/rust-ammonia/ammonia/releases/tag/v4.0.3
	security-advisories@github.com	https://github.com/rust-ammonia/ammonia/releases/tag/v4.1.4
	security-advisories@github.com	https://github.com/rust-ammonia/ammonia/security/advisories/GHSA-m6mh-2hw2-555x

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "ammonia",
          "vendor": "rust-ammonia",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.3.3"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.0.0, \u003c 4.0.3"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.1.2, \u003c 4.1.4"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "ammonia is a Rust library for repairing and securing untrusted HTML. Prior to 3.3.3, 4.0.3, and 4.1.4, applications that allow the SVG animate or set elements can retain an animation whose attributeName targets href and whose value uses the javascript scheme. The sanitized SVG can therefore create a script-bearing link, and a user who clicks the link can execute attacker-controlled script in the application\u0027s origin, enabling stored cross-site scripting. This issue is fixed in versions 3.3.3, 4.0.3, and 4.1.4."
    }
  ],
  "id": "CVE-2026-102342",
  "lastModified": "2026-10-16T20:04:29.760",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 2.7,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-102342",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-10-13T20:13:15.972756Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-10-13T15:17:30.177",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/rust-ammonia/ammonia/commit/9394bd81179e756cb911314deabd943f1a9c8989"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/rust-ammonia/ammonia/commit/9e3335e2dd8ab07346ff7997f20662a3da4023f6"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/rust-ammonia/ammonia/commit/d2ae1547f478bd84d158bc5e57f5d31437dc4d8d"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/rust-ammonia/ammonia/pull/250"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/rust-ammonia/ammonia/pull/251"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/rust-ammonia/ammonia/pull/252"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/rust-ammonia/ammonia/releases/tag/v3.3.3"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/rust-ammonia/ammonia/releases/tag/v4.0.3"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/rust-ammonia/ammonia/releases/tag/v4.1.4"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/rust-ammonia/ammonia/security/advisories/GHSA-m6mh-2hw2-555x"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-M6MH-2HW2-555X

Vulnerability from github – Published: 2026-09-29 23:09 – Updated: 2026-09-29 23:09

Summary

Ammonia: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Details

The following SVG will produce a link with a javascript scheme. If the user clicks this link, they will run it.

<svg xmlns="http://www.w3.org/2000/svg">
  <a>
    <set attributeName="href" to="javascript:alert('SET_XSS')"></set>
    <text y="30">Click set</text>
  </a>
</svg>

Impact

Allows stored XSS in applications that allow the animate and set tags.

Patches

Fixed in 3.3.3, 4.0.3, and 4.1.4

Workarounds

Do not enable the animate or set tags.

Severity

5.4 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c 3.3.2"
      },
      "package": {
        "ecosystem": "crates.io",
        "name": "ammonia"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.3.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 4.0.2"
      },
      "package": {
        "ecosystem": "crates.io",
        "name": "ammonia"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.0.0"
            },
            {
              "fixed": "4.0.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 4.1.3"
      },
      "package": {
        "ecosystem": "crates.io",
        "name": "ammonia"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.1.2"
            },
            {
              "fixed": "4.1.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-102342"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-29T23:09:16Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "The following SVG will produce a link with a `javascript` scheme. If the user clicks this link, they will run it.\n\n```svg\n\u003csvg xmlns=\"http://www.w3.org/2000/svg\"\u003e\n  \u003ca\u003e\n    \u003cset attributeName=\"href\" to=\"javascript:alert(\u0027SET_XSS\u0027)\"\u003e\u003c/set\u003e\n    \u003ctext y=\"30\"\u003eClick set\u003c/text\u003e\n  \u003c/a\u003e\n\u003c/svg\u003e\n```\n\n### Impact\n\nAllows stored XSS in applications that allow the `animate` and `set` tags.\n\n### Patches\n\nFixed in 3.3.3, 4.0.3, and 4.1.4\n\n### Workarounds\n\nDo not enable the `animate` or `set` tags.",
  "id": "GHSA-m6mh-2hw2-555x",
  "modified": "2026-09-29T23:09:16Z",
  "published": "2026-09-29T23:09:16Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/rust-ammonia/ammonia/security/advisories/GHSA-m6mh-2hw2-555x"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rust-ammonia/ammonia/pull/250"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rust-ammonia/ammonia/pull/251"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rust-ammonia/ammonia/pull/252"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rust-ammonia/ammonia/commit/9394bd81179e756cb911314deabd943f1a9c8989"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rust-ammonia/ammonia/commit/9e3335e2dd8ab07346ff7997f20662a3da4023f6"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rust-ammonia/ammonia/commit/d2ae1547f478bd84d158bc5e57f5d31437dc4d8d"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/rust-ammonia/ammonia"
    },
    {
      "type": "WEB",
      "url": "https://rustsec.org/advisories/RUSTSEC-2026-0213.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Ammonia: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
}

MSRC_CVE-2026-102342

Vulnerability from csaf_microsoft - Published: 2026-10-15 01:11 - Updated: 2026-10-16 01:52

Summary

ammonia allows stored XSS through unsanitized SVG animate and set attributes

Scope

1 vulnerability in this advisory, including CVE-2026-102342.

CVE-2026-102342

Known not affected: 2 products

Open the full advisory

RUSTSEC-2026-0213 (CVE-2026-102342)

Vulnerability from osv_rustsec – Published: 2026-07-21 12:00 – Updated: 2026-09-30 07:15 – Source website

Summary

XSS in ammonia via SVG `animate` and `set` animation tags

Details

The following SVG will produce a link with a javascript scheme. If the user clicks this link, they will run it.

<svg xmlns="http://www.w3.org/2000/svg">
  <a>
    <set attributeName="href" to="javascript:alert('SET_XSS')"></set>
    <text y="30">Click set</text>
  </a>
</svg>

Ammonia did not apply attribute filters based on attributeName, so the contents of the to, from, and values tags were not sanitized as URLs.

Applications that do not explicitly allow either of these tags should not be affected, since neither are allowed by default.

Discovered by: Younghun Ko (@koyokr)

References

URL

Type

	https://crates.io/crates/ammonia	PACKAGE
	https://rustsec.org/advisories/RUSTSEC-2026-0213.html	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "categories": [
          "format-injection"
        ],
        "cvss": null,
        "informational": null
      },
      "ecosystem_specific": {
        "affected_functions": null,
        "affects": {
          "arch": [],
          "functions": [],
          "os": []
        }
      },
      "package": {
        "ecosystem": "crates.io",
        "name": "ammonia",
        "purl": "pkg:cargo/ammonia"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.0.0-0"
            },
            {
              "fixed": "3.3.3"
            },
            {
              "introduced": "4.0.0"
            },
            {
              "fixed": "4.0.3"
            },
            {
              "introduced": "4.1.0"
            },
            {
              "fixed": "4.1.4"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "versions": []
    }
  ],
  "aliases": [
    "CVE-2026-102342",
    "GHSA-m6mh-2hw2-555x"
  ],
  "database_specific": {
    "license": "CC0-1.0"
  },
  "details": "The following SVG will produce a link with a javascript scheme.\nIf the user clicks this link, they will run it.\n\n```xml\n\u003csvg xmlns=\"http://www.w3.org/2000/svg\"\u003e\n  \u003ca\u003e\n    \u003cset attributeName=\"href\" to=\"javascript:alert(\u0027SET_XSS\u0027)\"\u003e\u003c/set\u003e\n    \u003ctext y=\"30\"\u003eClick set\u003c/text\u003e\n  \u003c/a\u003e\n\u003c/svg\u003e\n```\n\nAmmonia did not apply attribute filters based on `attributeName`,\nso the contents of the `to`, `from`, and `values` tags were not sanitized as URLs.\n\nApplications that do not explicitly allow either of these tags should not be affected,\nsince neither are allowed by default.\n\n---\n\n**Discovered by:** [Younghun Ko (@koyokr)](https://github.com/koyokr)",
  "id": "RUSTSEC-2026-0213",
  "modified": "2026-09-30T07:15:39Z",
  "published": "2026-07-21T12:00:00Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://crates.io/crates/ammonia"
    },
    {
      "type": "ADVISORY",
      "url": "https://rustsec.org/advisories/RUSTSEC-2026-0213.html"
    }
  ],
  "related": [],
  "severity": [],
  "summary": "XSS in ammonia via SVG `animate` and `set` animation tags"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-102342 (GCVE-0-2026-102342)

FKIE_CVE-2026-102342

GHSA-M6MH-2HW2-555X

Impact

Patches

Workarounds

MSRC_CVE-2026-102342

RUSTSEC-2026-0213 (CVE-2026-102342)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour