CVE-2026-102342: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in rust-ammonia ammonia

The ammonia Rust library versions before 3.3.3, between 4.0.0 and before 4.0.3, and between 4.1.2 and before 4.1.4 contain a stored cross-site scripting vulnerability. This occurs because sanitized SVG elements (animate or set) can retain an animation whose attributeName targets href with a javascript scheme value. This allows an attacker to embed a script-bearing link in sanitized HTML, which executes attacker-controlled JavaScript in the application's origin when a user clicks the link. The vulnerability is identified as CWE-79 (Improper Neutralization of Input During Web Page Generation).

An attacker can craft SVG content that, after sanitization by vulnerable ammonia versions, contains a link that executes arbitrary JavaScript in the context of the vulnerable application when clicked by a user. This enables stored cross-site scripting attacks, potentially leading to information disclosure or session hijacking within the application's origin. The CVSS 3.1 base score is 5.4 (medium severity), reflecting network attack vector, low attack complexity, required privileges, user interaction, and partial confidentiality and integrity impact without availability impact.

Upgrade ammonia to version 3.3.3, 4.0.3, or 4.1.4 or later, where this vulnerability is fixed. No other mitigation is indicated or required as the fix is available in these versions.