From baa969879dafda1eea1e7a58da379edbb58852e3 Mon Sep 17 00:00:00 2001 From: Michael Howell Date: Sun, 21 Sep 2025 18:38:37 -0700 Subject: [PATCH] ammonia v4.1.2 --- crates/ammonia/RUSTSEC-0000-0000.md | 39 +++++++++++++++++++++++++++++ 1 file changed, 39 insertions(+) create mode 100644 crates/ammonia/RUSTSEC-0000-0000.md diff --git a/crates/ammonia/RUSTSEC-0000-0000.md b/crates/ammonia/RUSTSEC-0000-0000.md new file mode 100644 index 00000000..fa08ba23 --- /dev/null +++ b/crates/ammonia/RUSTSEC-0000-0000.md @@ -0,0 +1,39 @@ +```toml +[advisory] +id = "RUSTSEC-0000-0000" +package = "ammonia" +date = "2025-09-21" +categories = ["format-injection"] +keywords = ["html", "xss"] + +[versions] +patched = [">= 4.1.2", ">= 4.0.1, < 4.1.0", ">= 3.3.1, < 4.0.0"] +``` + +# Incorrect handling of embedded SVG and MathML leads to mutation XSS after removal + +Affected versions of this crate did not correctly strip namespace-incompatible tags +in certain situations, causing it to incorrectly account for differences between HTML, +SVG, and MathML. + +This vulnerability only has an effect when the `svg` or `math` tag is allowed, +because it relies on a tag being parsed as html during the cleaning process, but +serialized in a way that causes in to be parsed as xml by the browser. + +Additionally, the application using this library must allow a tag that is parsed as raw text in HTML. +These [elements] are: + +* title +* textarea +* xmp +* iframe +* noembed +* noframes +* plaintext +* noscript +* style +* script + +Applications that do not explicitly allow any of these tags should not be affected, since none are allowed by default. + +[elements]: https://github.com/servo/html5ever/blob/57eb334c0ffccc6f88d563419f0fbeef6ff5741c/html5ever/src/tree_builder/rules.rs