https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T08:57:09.443899+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/ghsa-m6mh-2hw2-555x GHSA-m6mh-2hw2-555x — Ammonia: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') 2026-10-02T08:57:09.445156+00:00

Affected: crates.io: ammonia

The following SVG will produce a link with a `javascript` scheme. If the user clicks this link, they will run it.

```svg <svg xmlns="http://www.w3.org/2000/svg"> <a> <set attributeName="href" to="javascript:alert('SET_XSS')"></set> <text y="30">Click set</text> </a> </svg> ```

### Impact

Allows stored XSS in applications that allow the `animate` and `set` tags.

### Patches

Fixed in 3.3.3, 4.0.3, and 4.1.4

### Workarounds

Do not enable the `animate` or `set` tags.