CVE-2026-102342: Ammonia Package Vulnerability Leading to Cross-site Scripting (XSS)
Summary
CVE-2026-102342: Ammonia: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Affects ammonia across 3 version ranges.
< 3.3.3
>= 4.0.0, < 4.0.3
>= 4.1.2, < 4.1.4
Fixed in 3.3.3, 4.0.3 or 4.1.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ammonia is a Rust library designed for sanitizing HTML and SVG content to prevent security vulnerabilities such as XSS. It is widely used in web applications to ensure that user-generated content is safe for rendering in browsers. However, a recent vulnerability has been discovered that allows improper neutralization of input during web page generation, specifically through the use of SVG tags.
Vulnerability Detail
The vulnerability arises from the improper handling of SVG elements, particularly the 'animate' and 'set' tags. An attacker can craft an SVG that includes a link with a 'javascript' scheme, which, when clicked by a user, executes arbitrary JavaScript code. This can lead to stored XSS attacks, allowing attackers to execute scripts in the context of the user's session, potentially compromising sensitive information or performing actions on behalf of the user.
How To Fix
Latest published version: 4.2.4 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 3.3.33.3.3 -
>= 4.0.0, < 4.0.34.0.3 -
>= 4.1.2, < 4.1.44.1.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, do not enable the 'animate' or 'set' tags in your SVG content. This can help mitigate the risk of XSS until you can update to a patched version.
Conclusion
The Ammonia package has a vulnerability that allows for cross-site scripting through specific SVG tags. It is crucial to update to the patched versions to safeguard your applications. Additionally, using Vulert can help you monitor for such vulnerabilities in real-time.
See every vulnerability recorded for ammonia →
FAQ
The vulnerability allows for stored XSS through improperly handled SVG elements in the Ammonia package.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Check your application against the vulnerability using the Vulert playground at Vulert Scanner.
If exploited, this vulnerability can lead to unauthorized script execution in the user's browser, potentially compromising user data and session integrity.
Yes, you can temporarily disable the use of 'animate' and 'set' tags in your SVG content to reduce the risk of exploitation.
The CVSS score for this vulnerability is 5.4, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for ammonia.
