RUSTSEC-2021-0158

XSS in ammonia via SVG animateMotion, animateTransform, and/or animateColor tags

Reported

October 10, 2021

Issued

October 13, 2026

Package

ammonia (crates.io)

Type

Vulnerability

Categories

format-injection

Keywords

#html #xss

Aliases

GHSA-f2pc-rwv3-69mv

References

https://github.com/rust-ammonia/ammonia/pull/261

Patched

>=4.2.3
>=4.1.7, <4.2.0

Description

The neutralization that ammonia applied to animate and set was not applied to other forms of SVG animation, which can be used for XSS.

The following SVG will produce a link with a javascript scheme. If the user clicks this link, they will run it.

<svg xmlns="http://www.w3.org/2000/svg">
  <a>
    <animateMotion attributeName="href" to="javascript:alert('SET_XSS')"></animateMotion>
    <text y="30">Click set</text>
  </a>
</svg>

Ammonia did not apply attribute filters based on attributeName, so the contents of the to, from, and values tags were not sanitized as URLs.

Applications that do not explicitly allow any of these tags should not be affected, since none are allowed by default.

This vulnerability was reported by ucsurf.

Advisory available under CC0-1.0 license.