CVE-2026-63430: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in rust-ammonia ammonia

The rust-ammonia library, used for sanitizing untrusted HTML, improperly handles annotation-xml's encoding-dependent MathML integration-point behavior after attribute filtering removes the encoding attribute. This leads to a mismatch between the sanitizer's namespace validation and the browser's reparsing, enabling mutation cross-site scripting (CWE-79) when certain tags (math, annotation-xml, and raw-text HTML elements) are allowed. This vulnerability affects versions prior to 3.3.2, versions from 4.0.0 up to but not including 4.0.2, and versions from 4.1.0 up to but not including 4.1.3. The vulnerability is medium severity with a CVSS 4.0 score of 6.3. The issue is resolved in versions 3.3.2, 4.0.2, and 4.1.3.

An attacker can exploit this vulnerability to execute arbitrary JavaScript in the context of a user's browser when rendering sanitized HTML output. This can lead to typical XSS impacts such as session hijacking or unauthorized actions. However, the vulnerability only affects applications that explicitly enable the vulnerable tags and disable the encoding attribute, limiting the scope of impact.

Upgrade rust-ammonia to version 3.3.2, 4.0.2, or 4.1.3 or later, where this vulnerability is fixed. Applications that do not explicitly allow the math tag, annotation-xml, and raw-text HTML elements are not affected. No other mitigation is required if these tags are not enabled.