AIKIDO-2026-890476

ammonia is vulnerable to Cross-Site Scripting (XSS)

Cross-Site Scripting (XSS)GHSA-m6mh-2hw2-555x Published 4 days ago

Medium Risk

This Affects:

ammonia

3.2.0 - 3.3.2

Fixed in 3.3.3

4.0.0 - 4.0.2

Fixed in 4.0.3

4.1.0 - 4.1.3

Fixed in 4.1.4

Are you affected? Scan for Free

TL;DR

The ammonia HTML sanitizer applies attribute filters to SVG elements but did not sanitize values based on the attributeName referenced by SVG animate and set tags. Untrusted markup such as <set attributeName="href" to="javascript:alert('SET_XSS')"> inside an allowed <a> element can inject a javascript: URL that executes when a victim clicks the resulting link. The fix applies URL sanitization to to, from, and values content according to the targeted attribute name.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and your sanitizer configuration explicitly allows the SVG animate or set tags, which are disabled by default.