Most recent entries from all https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 08:57:09 +0000 GHSA-m6mh-2hw2-555x — Ammonia: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') https://cve.radiocsirt.org/vuln/ghsa-m6mh-2hw2-555x <p><strong>Affected:</strong> crates.io: ammonia</p> <p>The following SVG will produce a link with a `javascript` scheme. If the user clicks this link, they will run it.</p> <p>```svg &lt;svg xmlns=&#34;http://www.w3.org/2000/svg&#34;&gt; &lt;a&gt; &lt;set attributeName=&#34;href&#34; to=&#34;javascript:alert(&#39;SET_XSS&#39;)&#34;&gt;&lt;/set&gt; &lt;text y=&#34;30&#34;&gt;Click set&lt;/text&gt; &lt;/a&gt; &lt;/svg&gt; ```</p> <p>### Impact</p> <p>Allows stored XSS in applications that allow the `animate` and `set` tags.</p> <p>### Patches</p> <p>Fixed in 3.3.3, 4.0.3, and 4.1.4</p> <p>### Workarounds</p> <p>Do not enable the `animate` or `set` tags.</p> <p><strong>Affected:</strong> crates.io: ammonia</p> <p>The following SVG will produce a link with a `javascript` scheme. If the user clicks this link, they will run it.</p> <p>```svg &lt;svg xmlns=&#34;http://www.w3.org/2000/svg&#34;&gt; &lt;a&gt; &lt;set attributeName=&#34;href&#34; to=&#34;javascript:alert(&#39;SET_XSS&#39;)&#34;&gt;&lt;/set&gt; &lt;text y=&#34;30&#34;&gt;Click set&lt;/text&gt; &lt;/a&gt; &lt;/svg&gt; ```</p> <p>### Impact</p> <p>Allows stored XSS in applications that allow the `animate` and `set` tags.</p> <p>### Patches</p> <p>Fixed in 3.3.3, 4.0.3, and 4.1.4</p> <p>### Workarounds</p> <p>Do not enable the `animate` or `set` tags.</p> https://cve.radiocsirt.org/vuln/ghsa-m6mh-2hw2-555x