Ammonia: Incorrect handling of embedded SVG and MathML leads to mutation XSS
Affects ammoniaSource GCVE Database
Fixed in 4.2.5 : patch ammonia soon.
Data as of 13 Nov 2026, 13:17 UTC
Rated High by Threat Radar's AI analysis
- Patch
- Available – fixed in 4.2.5, 4.1.9, 3.3.5
What to do
Upgrade ammonia to 4.2.5, 4.1.9 or 3.3.5.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
crates.ioammoniapkg:cargo/ammoniaOther threats | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
A patch is available and users should upgrade to Ammonia versions 3.3.5, 4.1.9, or 4.2.5 or later. Applications that do not explicitly allow raw text HTML tags such as `script`, `style`, `textarea`, and others listed are not affected by this vulnerability. No additional mitigation is required if these tags are not enabled.
Description
Ammonia versions prior to 3.3.5, between 4.0.0 and 4.1.9, and between 4.2.0 and 4.2.5 have a vulnerability where incorrect handling of embedded SVG and MathML namespaces can lead to mutation-based cross-site scripting (XSS). This occurs when MathML integration points contain tags from the SVG namespace or vice versa, allowing an attacker to inject JavaScript by exploiting parsing differences between HTML and foreign XML. The vulnerability requires the presence of certain raw text HTML tags, which are not allowed by default, reducing exposure risk.