Executive brief
Incorrect handling of embedded SVG and MathML leads to mutation XSS after removal
Affected products
- crates.io ammonia
Junglewise Threat Intelligence
RUSTSEC-2025-0071 - Incorrect handling of embedded SVG and MathML leads to mutation XSS after removal
Severity: info ยท Published 2025-09-21
Technologies: ammonia (crates.io). Vendors: crates.io.
Related threats
- RUSTSEC-2026-0213 - XSS in ammonia via SVG `animate` and `set` animation tags
- RUSTSEC-2026-0193 - mXSS in ammonia via MathML `annotation-xml` encoding strip
- Space bug in `clean_text`
- RUSTSEC-2022-0003 - Space bug in `clean_text`
- RUSTSEC-2021-0074 - Incorrect handling of embedded SVG and MathML leads to mutation XSS