Ammonia versions prior to 3.3.5, between 4.0.0 and 4.1.9, and between 4.2.0 and 4.2.5 have a vulnerability where incorrect handling of embedded SVG and MathML namespaces can lead to mutation-based cross-site scripting (XSS). This occurs when MathML integration points contain tags from the SVG namespace or vice versa, allowing an attacker to inject JavaScript by exploiting parsing differences between HTML and foreign XML. The vulnerability requires the presence of certain raw text HTML tags, which are not allowed by default, reducing exposure risk.