Stored Cross-Site Scripting Vulnerability in Ammonia Rust Library
CVE-2026-102342
What is CVE-2026-102342?
The Ammonia Rust library, designed for sanitizing untrusted HTML, contains a flaw that affects applications permitting certain SVG elements. In versions prior to 3.3.3, 4.0.3, and 4.1.4, these applications are susceptible to a stored cross-site scripting (XSS) attack. This occurs when an SVG animate or set element retains an animation with an attributeName targeting href, which can utilize the javascript scheme. Consequently, a sanitized SVG might create a link embedded with malicious scripts. If users click on this link, they inadvertently execute attacker-controlled scripts within the application's origin. This vulnerability has been resolved in the aforementioned versions, strengthening the security of the Ammonia library.
Affected Version(s)
ammonia < 3.3.3 < 3.3.3
ammonia >= 4.0.0, < 4.0.3 < 4.0.0, 4.0.3
ammonia >= 4.1.2, < 4.1.4 < 4.1.2, 4.1.4