https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-10T00:29:47.927728+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/rustsec-2026-0213 RUSTSEC-2026-0213 — XSS in ammonia via SVG `animate` and `set` animation tags 2026-10-10T00:29:47.934336+00:00

Affected: crates.io: ammonia

The following SVG will produce a link with a javascript scheme. If the user clicks this link, they will run it.

```xml <svg xmlns="http://www.w3.org/2000/svg"> <a> <set attributeName="href" to="javascript:alert('SET_XSS')"></set> <text y="30">Click set</text> </a> </svg> ```

Ammonia did not apply attribute filters based on `attributeName`, so the contents of the `to`, `from`, and `values` tags were not sanitized as URLs.

Applications that do not explicitly allow either of these tags should not be affected, since neither are allowed by default.

---

**Discovered by:** [Younghun Ko (@koyokr)](https://github.com/koyokr)