Ammonia versions prior to 3.3.5, between 4.0.0 and 4.1.9, and between 4.2.0 and 4.2.5 have a vulnerability where incorrect handling of embedded SVG and MathML namespaces can lead to mutation-based cross-site scripting (XSS). This occurs when MathML integration points contain tags from the SVG namespace or vice versa, allowing an attacker to inject JavaScript by exploiting parsing differences between HTML and foreign XML. The vulnerability requires the presence of certain raw text HTML tags, which are not allowed by default, reducing exposure risk.
If a certain set of MathML tags are enabled, an attacker can inject arbitrary JavaScript code into the user's browser.
The `annotation-xml` tag has slightly different behavior than the other "integration point"
tags in MathML and SVG, but ammonia didn't handle it, so it didn't correctly
strip the namespace-incompatible tags.
This vulnerability only has an effect when the `math` and `annotation-xml` tags
are both enabled, but the `encoding` attribute is disabled, because it relies
on the following sequence of steps:
1. User writes code like `<math><annotation-xml encoding="text/html"><gadget></annotation-xml></math>`.
2. Namespace filtering checks the DOM, and it passes. `<gadget>` is parsed as HTML.
3. Attribute filter strips it down to `<math><annotation-xml><gadget></annotation-xml></math>`. Because the encoding attribute is gone, `<gadget>` is now parsed as MathML.
4. The gadget is written in such a way that it exploits the parsing differences between HTML and MathML.
Additionally, the gadget can only be written using a tag that is parsed as raw text in HTML.
These [elements] are:
* title
* textarea
* xmp
* iframe
* noembed
* noframes
* plaintext
* noscript
* style
* script
Applications that do not explicitly allow any of these tags should not be affected, since none are allowed by default.
[elements]: https://github.com/servo/html5ever/blob/045a0378f2b0f8d4a350793899cf722a2a9b3d11/html5ever/src/tree_builder/rules.rs
### Impact
Low: Requires both MathML and at least one raw-text HTML tag to be enabled, and most websites don't enable either of those.
### Patches
- https://github.com/rust-ammonia/ammonia/pull/245 (released in 4.1.3)
- https://github.com/rust-ammonia/ammonia/pull/244 (released in 4.0.2)
- https://github.com/rust-ammonia/ammonia/pull/243 (released in 3.3.2)
### Workarounds
Call <code>builder.[add_clean_content_tags](https://docs.rs/ammonia/latest/ammonia/struct.Builder.html#method.add_clean_content_tags)("annotation-xml")</code> to remove the annotation-xml element and all of its children, including the XSS gadget.
CVE-2026-102342 is a stored cross-site scripting (XSS) vulnerability in the rust-ammonia library, which is used to sanitize untrusted HTML. Versions prior to 3.3.3, 4.0.3, and 4.1.4 allow SVG animate or set elements with an attributeName targeting href and a javascript scheme value to persist. This enables attackers to embed script-bearing links that execute attacker-controlled scripts in the application's origin when clicked. The issue is fixed in versions 3.3.3, 4.0.3, and 4.1.4.