https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 12:00:56 +0000 https://vulnerability.circl.lu/vuln/rustsec-2026-0213 <p><strong>Affected:</strong> crates.io: ammonia</p> <p>The following SVG will produce a link with a javascript scheme. If the user clicks this link, they will run it.</p> <p>```xml &lt;svg xmlns=&#34;http://www.w3.org/2000/svg&#34;&gt; &lt;a&gt; &lt;set attributeName=&#34;href&#34; to=&#34;javascript:alert(&#39;SET_XSS&#39;)&#34;&gt;&lt;/set&gt; &lt;text y=&#34;30&#34;&gt;Click set&lt;/text&gt; &lt;/a&gt; &lt;/svg&gt; ```</p> <p>Ammonia did not apply attribute filters based on `attributeName`, so the contents of the `to`, `from`, and `values` tags were not sanitized as URLs.</p> <p>Applications that do not explicitly allow either of these tags should not be affected, since neither are allowed by default.</p> <p>---</p> <p>**Discovered by:** [Younghun Ko (@koyokr)](https://github.com/koyokr)</p> <p><strong>Affected:</strong> crates.io: ammonia</p> <p>The following SVG will produce a link with a javascript scheme. If the user clicks this link, they will run it.</p> <p>```xml &lt;svg xmlns=&#34;http://www.w3.org/2000/svg&#34;&gt; &lt;a&gt; &lt;set attributeName=&#34;href&#34; to=&#34;javascript:alert(&#39;SET_XSS&#39;)&#34;&gt;&lt;/set&gt; &lt;text y=&#34;30&#34;&gt;Click set&lt;/text&gt; &lt;/a&gt; &lt;/svg&gt; ```</p> <p>Ammonia did not apply attribute filters based on `attributeName`, so the contents of the `to`, `from`, and `values` tags were not sanitized as URLs.</p> <p>Applications that do not explicitly allow either of these tags should not be affected, since neither are allowed by default.</p> <p>---</p> <p>**Discovered by:** [Younghun Ko (@koyokr)](https://github.com/koyokr)</p> https://vulnerability.circl.lu/vuln/rustsec-2026-0213