ammonia

The following SVG will produce a link with a javascript scheme. If the user clicks this link, they will run it.

<svg xmlns="http://www.w3.org/2000/svg">
  <a>
    <set attributeName="href" to="javascript:alert('SET_XSS')"></set>
    <text y="30">Click set</text>
  </a>
</svg>

Ammonia did not apply attribute filters based on attributeName, so the contents of the to, from, and values tags were not sanitized as URLs.

Applications that do not explicitly allow either of these tags should not be affected, since neither are allowed by default.

Discovered by: Younghun Ko (@koyokr)

The following SVG will produce a link with a javascript scheme. If the user clicks this link, they will run it.

<svg xmlns="http://www.w3.org/2000/svg">
  <a>
    <set attributeName="href" to="javascript:alert('SET_XSS')"></set>
    <text y="30">Click set</text>
  </a>
</svg>

Ammonia did not apply attribute filters based on attributeName, so the contents of the to, from, and values tags were not sanitized as URLs.

Applications that do not explicitly allow either of these tags should not be affected, since neither are allowed by default.

Discovered by: Younghun Ko (@koyokr)

The following SVG will produce a link with a javascript scheme. If the user clicks this link, they will run it.

<svg xmlns="http://www.w3.org/2000/svg">
  <a>
    <set attributeName="href" to="javascript:alert('SET_XSS')"></set>
    <text y="30">Click set</text>
  </a>
</svg>

Ammonia did not apply attribute filters based on attributeName, so the contents of the to, from, and values tags were not sanitized as URLs.

Applications that do not explicitly allow either of these tags should not be affected, since neither are allowed by default.

Discovered by: Younghun Ko (@koyokr)

The following SVG will produce a link with a javascript scheme. If the user clicks this link, they will run it.

<svg xmlns="http://www.w3.org/2000/svg">
  <a>
    <set attributeName="href" to="javascript:alert('SET_XSS')"></set>
    <text y="30">Click set</text>
  </a>
</svg>

Ammonia did not apply attribute filters based on attributeName, so the contents of the to, from, and values tags were not sanitized as URLs.

Applications that do not explicitly allow either of these tags should not be affected, since neither are allowed by default.

Discovered by: Younghun Ko (@koyokr)

If a certain set of MathML tags are enabled, an attacker can inject arbitrary JavaScript code into the user's browser.

The annotation-xml tag has slightly different behavior than the other "integration point" tags in MathML and SVG, but ammonia didn't handle it, so it didn't correctly strip the namespace-incompatible tags.

This vulnerability only has an effect when the math and annotation-xml tags are both enabled, but the encoding attribute is disabled, because it relies on the following sequence of steps:

1. User writes code like <math><annotation-xml encoding="text/html"><gadget></annotation-xml></math>.
2. Namespace filtering checks the DOM, and it passes. <gadget> is parsed as HTML.
3. Attribute filter strips it down to <math><annotation-xml><gadget></annotation-xml></math>. Because the encoding attribute is gone, <gadget> is now parsed as MathML.
4. The gadget is written in such a way that it exploits the parsing differences between HTML and MathML.

Additionally, the gadget can only be written using a tag that is parsed as raw text in HTML. These elements are:

• title
• textarea
• xmp
• iframe
• noembed
• noframes
• plaintext
• noscript
• style
• script

Applications that do not explicitly allow any of these tags should not be affected, since none are allowed by default.

Discovered by: Ivan Ivančić · Date: 2026-06-29 · Found via local differential analysis and source review of ammonia's sanitisation pipeline; no third-party systems were tested.

The following SVG will produce a link with a javascript scheme. If the user clicks this link, they will run it.

<svg xmlns="http://www.w3.org/2000/svg">
  <a>
    <set attributeName="href" to="javascript:alert('SET_XSS')"></set>
    <text y="30">Click set</text>
  </a>
</svg>

Ammonia did not apply attribute filters based on attributeName, so the contents of the to, from, and values tags were not sanitized as URLs.

Applications that do not explicitly allow either of these tags should not be affected, since neither are allowed by default.

Discovered by: Younghun Ko (@koyokr)

If a certain set of MathML tags are enabled, an attacker can inject arbitrary JavaScript code into the user's browser.

The annotation-xml tag has slightly different behavior than the other "integration point" tags in MathML and SVG, but ammonia didn't handle it, so it didn't correctly strip the namespace-incompatible tags.

This vulnerability only has an effect when the math and annotation-xml tags are both enabled, but the encoding attribute is disabled, because it relies on the following sequence of steps:

1. User writes code like <math><annotation-xml encoding="text/html"><gadget></annotation-xml></math>.
2. Namespace filtering checks the DOM, and it passes. <gadget> is parsed as HTML.
3. Attribute filter strips it down to <math><annotation-xml><gadget></annotation-xml></math>. Because the encoding attribute is gone, <gadget> is now parsed as MathML.
4. The gadget is written in such a way that it exploits the parsing differences between HTML and MathML.

Additionally, the gadget can only be written using a tag that is parsed as raw text in HTML. These elements are:

• title
• textarea
• xmp
• iframe
• noembed
• noframes
• plaintext
• noscript
• style
• script

Applications that do not explicitly allow any of these tags should not be affected, since none are allowed by default.

Discovered by: Ivan Ivančić · Date: 2026-06-29 · Found via local differential analysis and source review of ammonia's sanitisation pipeline; no third-party systems were tested.

The following SVG will produce a link with a javascript scheme. If the user clicks this link, they will run it.

<svg xmlns="http://www.w3.org/2000/svg">
  <a>
    <set attributeName="href" to="javascript:alert('SET_XSS')"></set>
    <text y="30">Click set</text>
  </a>
</svg>

Ammonia did not apply attribute filters based on attributeName, so the contents of the to, from, and values tags were not sanitized as URLs.

Applications that do not explicitly allow either of these tags should not be affected, since neither are allowed by default.

Discovered by: Younghun Ko (@koyokr)

If a certain set of MathML tags are enabled, an attacker can inject arbitrary JavaScript code into the user's browser.

The annotation-xml tag has slightly different behavior than the other "integration point" tags in MathML and SVG, but ammonia didn't handle it, so it didn't correctly strip the namespace-incompatible tags.

This vulnerability only has an effect when the math and annotation-xml tags are both enabled, but the encoding attribute is disabled, because it relies on the following sequence of steps:

1. User writes code like <math><annotation-xml encoding="text/html"><gadget></annotation-xml></math>.
2. Namespace filtering checks the DOM, and it passes. <gadget> is parsed as HTML.
3. Attribute filter strips it down to <math><annotation-xml><gadget></annotation-xml></math>. Because the encoding attribute is gone, <gadget> is now parsed as MathML.
4. The gadget is written in such a way that it exploits the parsing differences between HTML and MathML.

Additionally, the gadget can only be written using a tag that is parsed as raw text in HTML. These elements are:

• title
• textarea
• xmp
• iframe
• noembed
• noframes
• plaintext
• noscript
• style
• script

Applications that do not explicitly allow any of these tags should not be affected, since none are allowed by default.

Discovered by: Ivan Ivančić · Date: 2026-06-29 · Found via local differential analysis and source review of ammonia's sanitisation pipeline; no third-party systems were tested.

The following SVG will produce a link with a javascript scheme. If the user clicks this link, they will run it.

<svg xmlns="http://www.w3.org/2000/svg">
  <a>
    <set attributeName="href" to="javascript:alert('SET_XSS')"></set>
    <text y="30">Click set</text>
  </a>
</svg>

Ammonia did not apply attribute filters based on attributeName, so the contents of the to, from, and values tags were not sanitized as URLs.

Applications that do not explicitly allow either of these tags should not be affected, since neither are allowed by default.

Discovered by: Younghun Ko (@koyokr)

If a certain set of MathML tags are enabled, an attacker can inject arbitrary JavaScript code into the user's browser.

The annotation-xml tag has slightly different behavior than the other "integration point" tags in MathML and SVG, but ammonia didn't handle it, so it didn't correctly strip the namespace-incompatible tags.

This vulnerability only has an effect when the math and annotation-xml tags are both enabled, but the encoding attribute is disabled, because it relies on the following sequence of steps:

1. User writes code like <math><annotation-xml encoding="text/html"><gadget></annotation-xml></math>.
2. Namespace filtering checks the DOM, and it passes. <gadget> is parsed as HTML.
3. Attribute filter strips it down to <math><annotation-xml><gadget></annotation-xml></math>. Because the encoding attribute is gone, <gadget> is now parsed as MathML.
4. The gadget is written in such a way that it exploits the parsing differences between HTML and MathML.

Additionally, the gadget can only be written using a tag that is parsed as raw text in HTML. These elements are:

• title
• textarea
• xmp
• iframe
• noembed
• noframes
• plaintext
• noscript
• style
• script

Applications that do not explicitly allow any of these tags should not be affected, since none are allowed by default.

Discovered by: Ivan Ivančić · Date: 2026-06-29 · Found via local differential analysis and source review of ammonia's sanitisation pipeline; no third-party systems were tested.

Affected versions of this crate did not correctly strip namespace-incompatible tags in certain situations, causing it to incorrectly account for differences between HTML, SVG, and MathML.

This vulnerability only has an effect when the svg or math tag is allowed, because it relies on a tag being parsed as html during the cleaning process, but serialized in a way that causes in to be parsed as xml by the browser.

Additionally, the application using this library must allow a tag that is parsed as raw text in HTML. These elements are:

• title
• textarea
• xmp
• iframe
• noembed
• noframes
• plaintext
• noscript
• style
• script

Applications that do not explicitly allow any of these tags should not be affected, since none are allowed by default.

The following SVG will produce a link with a javascript scheme. If the user clicks this link, they will run it.

<svg xmlns="http://www.w3.org/2000/svg">
  <a>
    <set attributeName="href" to="javascript:alert('SET_XSS')"></set>
    <text y="30">Click set</text>
  </a>
</svg>

Ammonia did not apply attribute filters based on attributeName, so the contents of the to, from, and values tags were not sanitized as URLs.

Applications that do not explicitly allow either of these tags should not be affected, since neither are allowed by default.

Discovered by: Younghun Ko (@koyokr)

If a certain set of MathML tags are enabled, an attacker can inject arbitrary JavaScript code into the user's browser.

The annotation-xml tag has slightly different behavior than the other "integration point" tags in MathML and SVG, but ammonia didn't handle it, so it didn't correctly strip the namespace-incompatible tags.

This vulnerability only has an effect when the math and annotation-xml tags are both enabled, but the encoding attribute is disabled, because it relies on the following sequence of steps:

1. User writes code like <math><annotation-xml encoding="text/html"><gadget></annotation-xml></math>.
2. Namespace filtering checks the DOM, and it passes. <gadget> is parsed as HTML.
3. Attribute filter strips it down to <math><annotation-xml><gadget></annotation-xml></math>. Because the encoding attribute is gone, <gadget> is now parsed as MathML.
4. The gadget is written in such a way that it exploits the parsing differences between HTML and MathML.

Additionally, the gadget can only be written using a tag that is parsed as raw text in HTML. These elements are:

• title
• textarea
• xmp
• iframe
• noembed
• noframes
• plaintext
• noscript
• style
• script

Applications that do not explicitly allow any of these tags should not be affected, since none are allowed by default.

Discovered by: Ivan Ivančić · Date: 2026-06-29 · Found via local differential analysis and source review of ammonia's sanitisation pipeline; no third-party systems were tested.

Affected versions of this crate did not correctly strip namespace-incompatible tags in certain situations, causing it to incorrectly account for differences between HTML, SVG, and MathML.

This vulnerability only has an effect when the svg or math tag is allowed, because it relies on a tag being parsed as html during the cleaning process, but serialized in a way that causes in to be parsed as xml by the browser.

Additionally, the application using this library must allow a tag that is parsed as raw text in HTML. These elements are:

• title
• textarea
• xmp
• iframe
• noembed
• noframes
• plaintext
• noscript
• style
• script

Applications that do not explicitly allow any of these tags should not be affected, since none are allowed by default.

The following SVG will produce a link with a javascript scheme. If the user clicks this link, they will run it.

<svg xmlns="http://www.w3.org/2000/svg">
  <a>
    <set attributeName="href" to="javascript:alert('SET_XSS')"></set>
    <text y="30">Click set</text>
  </a>
</svg>

Ammonia did not apply attribute filters based on attributeName, so the contents of the to, from, and values tags were not sanitized as URLs.

Applications that do not explicitly allow either of these tags should not be affected, since neither are allowed by default.

Discovered by: Younghun Ko (@koyokr)

If a certain set of MathML tags are enabled, an attacker can inject arbitrary JavaScript code into the user's browser.

The annotation-xml tag has slightly different behavior than the other "integration point" tags in MathML and SVG, but ammonia didn't handle it, so it didn't correctly strip the namespace-incompatible tags.

This vulnerability only has an effect when the math and annotation-xml tags are both enabled, but the encoding attribute is disabled, because it relies on the following sequence of steps:

1. User writes code like <math><annotation-xml encoding="text/html"><gadget></annotation-xml></math>.
2. Namespace filtering checks the DOM, and it passes. <gadget> is parsed as HTML.
3. Attribute filter strips it down to <math><annotation-xml><gadget></annotation-xml></math>. Because the encoding attribute is gone, <gadget> is now parsed as MathML.
4. The gadget is written in such a way that it exploits the parsing differences between HTML and MathML.

Additionally, the gadget can only be written using a tag that is parsed as raw text in HTML. These elements are:

• title
• textarea
• xmp
• iframe
• noembed
• noframes
• plaintext
• noscript
• style
• script

Applications that do not explicitly allow any of these tags should not be affected, since none are allowed by default.

Discovered by: Ivan Ivančić · Date: 2026-06-29 · Found via local differential analysis and source review of ammonia's sanitisation pipeline; no third-party systems were tested.

Affected versions of this crate did not correctly strip namespace-incompatible tags in certain situations, causing it to incorrectly account for differences between HTML, SVG, and MathML.

This vulnerability only has an effect when the svg or math tag is allowed, because it relies on a tag being parsed as html during the cleaning process, but serialized in a way that causes in to be parsed as xml by the browser.

Additionally, the application using this library must allow a tag that is parsed as raw text in HTML. These elements are:

• title
• textarea
• xmp
• iframe
• noembed
• noframes
• plaintext
• noscript
• style
• script

Applications that do not explicitly allow any of these tags should not be affected, since none are allowed by default.

The following SVG will produce a link with a javascript scheme. If the user clicks this link, they will run it.

<svg xmlns="http://www.w3.org/2000/svg">
  <a>
    <set attributeName="href" to="javascript:alert('SET_XSS')"></set>
    <text y="30">Click set</text>
  </a>
</svg>

Ammonia did not apply attribute filters based on attributeName, so the contents of the to, from, and values tags were not sanitized as URLs.

Applications that do not explicitly allow either of these tags should not be affected, since neither are allowed by default.

Discovered by: Younghun Ko (@koyokr)

If a certain set of MathML tags are enabled, an attacker can inject arbitrary JavaScript code into the user's browser.

The annotation-xml tag has slightly different behavior than the other "integration point" tags in MathML and SVG, but ammonia didn't handle it, so it didn't correctly strip the namespace-incompatible tags.

This vulnerability only has an effect when the math and annotation-xml tags are both enabled, but the encoding attribute is disabled, because it relies on the following sequence of steps:

1. User writes code like <math><annotation-xml encoding="text/html"><gadget></annotation-xml></math>.
2. Namespace filtering checks the DOM, and it passes. <gadget> is parsed as HTML.
3. Attribute filter strips it down to <math><annotation-xml><gadget></annotation-xml></math>. Because the encoding attribute is gone, <gadget> is now parsed as MathML.
4. The gadget is written in such a way that it exploits the parsing differences between HTML and MathML.

Additionally, the gadget can only be written using a tag that is parsed as raw text in HTML. These elements are:

• title
• textarea
• xmp
• iframe
• noembed
• noframes
• plaintext
• noscript
• style
• script

Applications that do not explicitly allow any of these tags should not be affected, since none are allowed by default.

Discovered by: Ivan Ivančić · Date: 2026-06-29 · Found via local differential analysis and source review of ammonia's sanitisation pipeline; no third-party systems were tested.

Affected versions of this crate did not correctly strip namespace-incompatible tags in certain situations, causing it to incorrectly account for differences between HTML, SVG, and MathML.

This vulnerability only has an effect when the svg or math tag is allowed, because it relies on a tag being parsed as html during the cleaning process, but serialized in a way that causes in to be parsed as xml by the browser.

Additionally, the application using this library must allow a tag that is parsed as raw text in HTML. These elements are:

• title
• textarea
• xmp
• iframe
• noembed
• noframes
• plaintext
• noscript
• style
• script

Applications that do not explicitly allow any of these tags should not be affected, since none are allowed by default.

The following SVG will produce a link with a javascript scheme. If the user clicks this link, they will run it.

<svg xmlns="http://www.w3.org/2000/svg">
  <a>
    <set attributeName="href" to="javascript:alert('SET_XSS')"></set>
    <text y="30">Click set</text>
  </a>
</svg>

Ammonia did not apply attribute filters based on attributeName, so the contents of the to, from, and values tags were not sanitized as URLs.

Applications that do not explicitly allow either of these tags should not be affected, since neither are allowed by default.

Discovered by: Younghun Ko (@koyokr)

If a certain set of MathML tags are enabled, an attacker can inject arbitrary JavaScript code into the user's browser.

The annotation-xml tag has slightly different behavior than the other "integration point" tags in MathML and SVG, but ammonia didn't handle it, so it didn't correctly strip the namespace-incompatible tags.

This vulnerability only has an effect when the math and annotation-xml tags are both enabled, but the encoding attribute is disabled, because it relies on the following sequence of steps:

1. User writes code like <math><annotation-xml encoding="text/html"><gadget></annotation-xml></math>.
2. Namespace filtering checks the DOM, and it passes. <gadget> is parsed as HTML.
3. Attribute filter strips it down to <math><annotation-xml><gadget></annotation-xml></math>. Because the encoding attribute is gone, <gadget> is now parsed as MathML.
4. The gadget is written in such a way that it exploits the parsing differences between HTML and MathML.

Additionally, the gadget can only be written using a tag that is parsed as raw text in HTML. These elements are:

• title
• textarea
• xmp
• iframe
• noembed
• noframes
• plaintext
• noscript
• style
• script

Applications that do not explicitly allow any of these tags should not be affected, since none are allowed by default.

Discovered by: Ivan Ivančić · Date: 2026-06-29 · Found via local differential analysis and source review of ammonia's sanitisation pipeline; no third-party systems were tested.

Affected versions of this crate did not correctly strip namespace-incompatible tags in certain situations, causing it to incorrectly account for differences between HTML, SVG, and MathML.

This vulnerability only has an effect when the svg or math tag is allowed, because it relies on a tag being parsed as html during the cleaning process, but serialized in a way that causes in to be parsed as xml by the browser.

Additionally, the application using this library must allow a tag that is parsed as raw text in HTML. These elements are:

• title
• textarea
• xmp
• iframe
• noembed
• noframes
• plaintext
• noscript
• style
• script

Applications that do not explicitly allow any of these tags should not be affected, since none are allowed by default.

The following SVG will produce a link with a javascript scheme. If the user clicks this link, they will run it.

<svg xmlns="http://www.w3.org/2000/svg">
  <a>
    <set attributeName="href" to="javascript:alert('SET_XSS')"></set>
    <text y="30">Click set</text>
  </a>
</svg>

Ammonia did not apply attribute filters based on attributeName, so the contents of the to, from, and values tags were not sanitized as URLs.

Applications that do not explicitly allow either of these tags should not be affected, since neither are allowed by default.

Discovered by: Younghun Ko (@koyokr)

If a certain set of MathML tags are enabled, an attacker can inject arbitrary JavaScript code into the user's browser.

The annotation-xml tag has slightly different behavior than the other "integration point" tags in MathML and SVG, but ammonia didn't handle it, so it didn't correctly strip the namespace-incompatible tags.

This vulnerability only has an effect when the math and annotation-xml tags are both enabled, but the encoding attribute is disabled, because it relies on the following sequence of steps:

1. User writes code like <math><annotation-xml encoding="text/html"><gadget></annotation-xml></math>.
2. Namespace filtering checks the DOM, and it passes. <gadget> is parsed as HTML.
3. Attribute filter strips it down to <math><annotation-xml><gadget></annotation-xml></math>. Because the encoding attribute is gone, <gadget> is now parsed as MathML.
4. The gadget is written in such a way that it exploits the parsing differences between HTML and MathML.

Additionally, the gadget can only be written using a tag that is parsed as raw text in HTML. These elements are:

• title
• textarea
• xmp
• iframe
• noembed
• noframes
• plaintext
• noscript
• style
• script

Applications that do not explicitly allow any of these tags should not be affected, since none are allowed by default.

Discovered by: Ivan Ivančić · Date: 2026-06-29 · Found via local differential analysis and source review of ammonia's sanitisation pipeline; no third-party systems were tested.

Affected versions of this crate did not correctly strip namespace-incompatible tags in certain situations, causing it to incorrectly account for differences between HTML, SVG, and MathML.

This vulnerability only has an effect when the svg or math tag is allowed, because it relies on a tag being parsed as html during the cleaning process, but serialized in a way that causes in to be parsed as xml by the browser.

Additionally, the application using this library must allow a tag that is parsed as raw text in HTML. These elements are:

• title
• textarea
• xmp
• iframe
• noembed
• noframes
• plaintext
• noscript
• style
• script

Applications that do not explicitly allow any of these tags should not be affected, since none are allowed by default.

The following SVG will produce a link with a javascript scheme. If the user clicks this link, they will run it.

<svg xmlns="http://www.w3.org/2000/svg">
  <a>
    <set attributeName="href" to="javascript:alert('SET_XSS')"></set>
    <text y="30">Click set</text>
  </a>
</svg>

Ammonia did not apply attribute filters based on attributeName, so the contents of the to, from, and values tags were not sanitized as URLs.

Applications that do not explicitly allow either of these tags should not be affected, since neither are allowed by default.

Discovered by: Younghun Ko (@koyokr)

If a certain set of MathML tags are enabled, an attacker can inject arbitrary JavaScript code into the user's browser.

The annotation-xml tag has slightly different behavior than the other "integration point" tags in MathML and SVG, but ammonia didn't handle it, so it didn't correctly strip the namespace-incompatible tags.

This vulnerability only has an effect when the math and annotation-xml tags are both enabled, but the encoding attribute is disabled, because it relies on the following sequence of steps:

1. User writes code like <math><annotation-xml encoding="text/html"><gadget></annotation-xml></math>.
2. Namespace filtering checks the DOM, and it passes. <gadget> is parsed as HTML.
3. Attribute filter strips it down to <math><annotation-xml><gadget></annotation-xml></math>. Because the encoding attribute is gone, <gadget> is now parsed as MathML.
4. The gadget is written in such a way that it exploits the parsing differences between HTML and MathML.

Additionally, the gadget can only be written using a tag that is parsed as raw text in HTML. These elements are:

• title
• textarea
• xmp
• iframe
• noembed
• noframes
• plaintext
• noscript
• style
• script

Applications that do not explicitly allow any of these tags should not be affected, since none are allowed by default.

Discovered by: Ivan Ivančić · Date: 2026-06-29 · Found via local differential analysis and source review of ammonia's sanitisation pipeline; no third-party systems were tested.

Affected versions of this crate did not correctly strip namespace-incompatible tags in certain situations, causing it to incorrectly account for differences between HTML, SVG, and MathML.

This vulnerability only has an effect when the svg or math tag is allowed, because it relies on a tag being parsed as html during the cleaning process, but serialized in a way that causes in to be parsed as xml by the browser.

Additionally, the application using this library must allow a tag that is parsed as raw text in HTML. These elements are:

• title
• textarea
• xmp
• iframe
• noembed
• noframes
• plaintext
• noscript
• style
• script

Applications that do not explicitly allow any of these tags should not be affected, since none are allowed by default.

The following SVG will produce a link with a javascript scheme. If the user clicks this link, they will run it.

<svg xmlns="http://www.w3.org/2000/svg">
  <a>
    <set attributeName="href" to="javascript:alert('SET_XSS')"></set>
    <text y="30">Click set</text>
  </a>
</svg>

Ammonia did not apply attribute filters based on attributeName, so the contents of the to, from, and values tags were not sanitized as URLs.

Applications that do not explicitly allow either of these tags should not be affected, since neither are allowed by default.

Discovered by: Younghun Ko (@koyokr)

If a certain set of MathML tags are enabled, an attacker can inject arbitrary JavaScript code into the user's browser.

The annotation-xml tag has slightly different behavior than the other "integration point" tags in MathML and SVG, but ammonia didn't handle it, so it didn't correctly strip the namespace-incompatible tags.

This vulnerability only has an effect when the math and annotation-xml tags are both enabled, but the encoding attribute is disabled, because it relies on the following sequence of steps:

1. User writes code like <math><annotation-xml encoding="text/html"><gadget></annotation-xml></math>.
2. Namespace filtering checks the DOM, and it passes. <gadget> is parsed as HTML.
3. Attribute filter strips it down to <math><annotation-xml><gadget></annotation-xml></math>. Because the encoding attribute is gone, <gadget> is now parsed as MathML.
4. The gadget is written in such a way that it exploits the parsing differences between HTML and MathML.

Additionally, the gadget can only be written using a tag that is parsed as raw text in HTML. These elements are:

• title
• textarea
• xmp
• iframe
• noembed
• noframes
• plaintext
• noscript
• style
• script

Applications that do not explicitly allow any of these tags should not be affected, since none are allowed by default.

Discovered by: Ivan Ivančić · Date: 2026-06-29 · Found via local differential analysis and source review of ammonia's sanitisation pipeline; no third-party systems were tested.

Affected versions of this crate did not correctly strip namespace-incompatible tags in certain situations, causing it to incorrectly account for differences between HTML, SVG, and MathML.

This vulnerability only has an effect when the svg or math tag is allowed, because it relies on a tag being parsed as html during the cleaning process, but serialized in a way that causes in to be parsed as xml by the browser.

Additionally, the application using this library must allow a tag that is parsed as raw text in HTML. These elements are:

• title
• textarea
• xmp
• iframe
• noembed
• noframes
• plaintext
• noscript
• style
• script

Applications that do not explicitly allow any of these tags should not be affected, since none are allowed by default.

The following SVG will produce a link with a javascript scheme. If the user clicks this link, they will run it.

<svg xmlns="http://www.w3.org/2000/svg">
  <a>
    <set attributeName="href" to="javascript:alert('SET_XSS')"></set>
    <text y="30">Click set</text>
  </a>
</svg>

Ammonia did not apply attribute filters based on attributeName, so the contents of the to, from, and values tags were not sanitized as URLs.

Applications that do not explicitly allow either of these tags should not be affected, since neither are allowed by default.

Discovered by: Younghun Ko (@koyokr)

If a certain set of MathML tags are enabled, an attacker can inject arbitrary JavaScript code into the user's browser.

The annotation-xml tag has slightly different behavior than the other "integration point" tags in MathML and SVG, but ammonia didn't handle it, so it didn't correctly strip the namespace-incompatible tags.

This vulnerability only has an effect when the math and annotation-xml tags are both enabled, but the encoding attribute is disabled, because it relies on the following sequence of steps:

1. User writes code like <math><annotation-xml encoding="text/html"><gadget></annotation-xml></math>.
2. Namespace filtering checks the DOM, and it passes. <gadget> is parsed as HTML.
3. Attribute filter strips it down to <math><annotation-xml><gadget></annotation-xml></math>. Because the encoding attribute is gone, <gadget> is now parsed as MathML.
4. The gadget is written in such a way that it exploits the parsing differences between HTML and MathML.

Additionally, the gadget can only be written using a tag that is parsed as raw text in HTML. These elements are:

• title
• textarea
• xmp
• iframe
• noembed
• noframes
• plaintext
• noscript
• style
• script

Applications that do not explicitly allow any of these tags should not be affected, since none are allowed by default.

Discovered by: Ivan Ivančić · Date: 2026-06-29 · Found via local differential analysis and source review of ammonia's sanitisation pipeline; no third-party systems were tested.

Affected versions of this crate did not correctly strip namespace-incompatible tags in certain situations, causing it to incorrectly account for differences between HTML, SVG, and MathML.

This vulnerability only has an effect when the svg or math tag is allowed, because it relies on a tag being parsed as html during the cleaning process, but serialized in a way that causes in to be parsed as xml by the browser.

Additionally, the application using this library must allow a tag that is parsed as raw text in HTML. These elements are:

• title
• textarea
• xmp
• iframe
• noembed
• noframes
• plaintext
• noscript
• style
• script

Applications that do not explicitly allow any of these tags should not be affected, since none are allowed by default.

The following SVG will produce a link with a javascript scheme. If the user clicks this link, they will run it.

<svg xmlns="http://www.w3.org/2000/svg">
  <a>
    <set attributeName="href" to="javascript:alert('SET_XSS')"></set>
    <text y="30">Click set</text>
  </a>
</svg>

Ammonia did not apply attribute filters based on attributeName, so the contents of the to, from, and values tags were not sanitized as URLs.

Applications that do not explicitly allow either of these tags should not be affected, since neither are allowed by default.

Discovered by: Younghun Ko (@koyokr)

If a certain set of MathML tags are enabled, an attacker can inject arbitrary JavaScript code into the user's browser.

The annotation-xml tag has slightly different behavior than the other "integration point" tags in MathML and SVG, but ammonia didn't handle it, so it didn't correctly strip the namespace-incompatible tags.

This vulnerability only has an effect when the math and annotation-xml tags are both enabled, but the encoding attribute is disabled, because it relies on the following sequence of steps:

1. User writes code like <math><annotation-xml encoding="text/html"><gadget></annotation-xml></math>.
2. Namespace filtering checks the DOM, and it passes. <gadget> is parsed as HTML.
3. Attribute filter strips it down to <math><annotation-xml><gadget></annotation-xml></math>. Because the encoding attribute is gone, <gadget> is now parsed as MathML.
4. The gadget is written in such a way that it exploits the parsing differences between HTML and MathML.

Additionally, the gadget can only be written using a tag that is parsed as raw text in HTML. These elements are:

• title
• textarea
• xmp
• iframe
• noembed
• noframes
• plaintext
• noscript
• style
• script

Applications that do not explicitly allow any of these tags should not be affected, since none are allowed by default.

Discovered by: Ivan Ivančić · Date: 2026-06-29 · Found via local differential analysis and source review of ammonia's sanitisation pipeline; no third-party systems were tested.

Affected versions of this crate did not correctly strip namespace-incompatible tags in certain situations, causing it to incorrectly account for differences between HTML, SVG, and MathML.

This vulnerability only has an effect when the svg or math tag is allowed, because it relies on a tag being parsed as html during the cleaning process, but serialized in a way that causes in to be parsed as xml by the browser.

Additionally, the application using this library must allow a tag that is parsed as raw text in HTML. These elements are:

• title
• textarea
• xmp
• iframe
• noembed
• noframes
• plaintext
• noscript
• style
• script

Applications that do not explicitly allow any of these tags should not be affected, since none are allowed by default.

The following SVG will produce a link with a javascript scheme. If the user clicks this link, they will run it.

<svg xmlns="http://www.w3.org/2000/svg">
  <a>
    <set attributeName="href" to="javascript:alert('SET_XSS')"></set>
    <text y="30">Click set</text>
  </a>
</svg>

Ammonia did not apply attribute filters based on attributeName, so the contents of the to, from, and values tags were not sanitized as URLs.

Applications that do not explicitly allow either of these tags should not be affected, since neither are allowed by default.

Discovered by: Younghun Ko (@koyokr)

If a certain set of MathML tags are enabled, an attacker can inject arbitrary JavaScript code into the user's browser.

The annotation-xml tag has slightly different behavior than the other "integration point" tags in MathML and SVG, but ammonia didn't handle it, so it didn't correctly strip the namespace-incompatible tags.

This vulnerability only has an effect when the math and annotation-xml tags are both enabled, but the encoding attribute is disabled, because it relies on the following sequence of steps:

1. User writes code like <math><annotation-xml encoding="text/html"><gadget></annotation-xml></math>.
2. Namespace filtering checks the DOM, and it passes. <gadget> is parsed as HTML.
3. Attribute filter strips it down to <math><annotation-xml><gadget></annotation-xml></math>. Because the encoding attribute is gone, <gadget> is now parsed as MathML.
4. The gadget is written in such a way that it exploits the parsing differences between HTML and MathML.

Additionally, the gadget can only be written using a tag that is parsed as raw text in HTML. These elements are:

• title
• textarea
• xmp
• iframe
• noembed
• noframes
• plaintext
• noscript
• style
• script

Applications that do not explicitly allow any of these tags should not be affected, since none are allowed by default.

Discovered by: Ivan Ivančić · Date: 2026-06-29 · Found via local differential analysis and source review of ammonia's sanitisation pipeline; no third-party systems were tested.

Affected versions of this crate did not correctly strip namespace-incompatible tags in certain situations, causing it to incorrectly account for differences between HTML, SVG, and MathML.

This vulnerability only has an effect when the svg or math tag is allowed, because it relies on a tag being parsed as html during the cleaning process, but serialized in a way that causes in to be parsed as xml by the browser.

Additionally, the application using this library must allow a tag that is parsed as raw text in HTML. These elements are:

• title
• textarea
• xmp
• iframe
• noembed
• noframes
• plaintext
• noscript
• style
• script

Applications that do not explicitly allow any of these tags should not be affected, since none are allowed by default.

An incorrect mapping from HTML specification to ASCII codes was used. Because HTML treats the Form Feed as whitespace, code like this has an injection bug:

let html = format!("<div title={}>", clean_text(user_supplied_string));

Applications are not affected if they quote their attributes, or if they don't use clean_text at all.

The following SVG will produce a link with a javascript scheme. If the user clicks this link, they will run it.

<svg xmlns="http://www.w3.org/2000/svg">
  <a>
    <set attributeName="href" to="javascript:alert('SET_XSS')"></set>
    <text y="30">Click set</text>
  </a>
</svg>

Ammonia did not apply attribute filters based on attributeName, so the contents of the to, from, and values tags were not sanitized as URLs.

Applications that do not explicitly allow either of these tags should not be affected, since neither are allowed by default.

Discovered by: Younghun Ko (@koyokr)

If a certain set of MathML tags are enabled, an attacker can inject arbitrary JavaScript code into the user's browser.

The annotation-xml tag has slightly different behavior than the other "integration point" tags in MathML and SVG, but ammonia didn't handle it, so it didn't correctly strip the namespace-incompatible tags.

This vulnerability only has an effect when the math and annotation-xml tags are both enabled, but the encoding attribute is disabled, because it relies on the following sequence of steps:

1. User writes code like <math><annotation-xml encoding="text/html"><gadget></annotation-xml></math>.
2. Namespace filtering checks the DOM, and it passes. <gadget> is parsed as HTML.
3. Attribute filter strips it down to <math><annotation-xml><gadget></annotation-xml></math>. Because the encoding attribute is gone, <gadget> is now parsed as MathML.
4. The gadget is written in such a way that it exploits the parsing differences between HTML and MathML.

Additionally, the gadget can only be written using a tag that is parsed as raw text in HTML. These elements are:

• title
• textarea
• xmp
• iframe
• noembed
• noframes
• plaintext
• noscript
• style
• script

Applications that do not explicitly allow any of these tags should not be affected, since none are allowed by default.

Discovered by: Ivan Ivančić · Date: 2026-06-29 · Found via local differential analysis and source review of ammonia's sanitisation pipeline; no third-party systems were tested.

Affected versions of this crate did not correctly strip namespace-incompatible tags in certain situations, causing it to incorrectly account for differences between HTML, SVG, and MathML.

This vulnerability only has an effect when the svg or math tag is allowed, because it relies on a tag being parsed as html during the cleaning process, but serialized in a way that causes in to be parsed as xml by the browser.

Additionally, the application using this library must allow a tag that is parsed as raw text in HTML. These elements are:

• title
• textarea
• xmp
• iframe
• noembed
• noframes
• plaintext
• noscript
• style
• script

Applications that do not explicitly allow any of these tags should not be affected, since none are allowed by default.

An incorrect mapping from HTML specification to ASCII codes was used. Because HTML treats the Form Feed as whitespace, code like this has an injection bug:

let html = format!("<div title={}>", clean_text(user_supplied_string));

Applications are not affected if they quote their attributes, or if they don't use clean_text at all.

The following SVG will produce a link with a javascript scheme. If the user clicks this link, they will run it.

<svg xmlns="http://www.w3.org/2000/svg">
  <a>
    <set attributeName="href" to="javascript:alert('SET_XSS')"></set>
    <text y="30">Click set</text>
  </a>
</svg>

Ammonia did not apply attribute filters based on attributeName, so the contents of the to, from, and values tags were not sanitized as URLs.

Applications that do not explicitly allow either of these tags should not be affected, since neither are allowed by default.

Discovered by: Younghun Ko (@koyokr)

If a certain set of MathML tags are enabled, an attacker can inject arbitrary JavaScript code into the user's browser.

The annotation-xml tag has slightly different behavior than the other "integration point" tags in MathML and SVG, but ammonia didn't handle it, so it didn't correctly strip the namespace-incompatible tags.

This vulnerability only has an effect when the math and annotation-xml tags are both enabled, but the encoding attribute is disabled, because it relies on the following sequence of steps:

1. User writes code like <math><annotation-xml encoding="text/html"><gadget></annotation-xml></math>.
2. Namespace filtering checks the DOM, and it passes. <gadget> is parsed as HTML.
3. Attribute filter strips it down to <math><annotation-xml><gadget></annotation-xml></math>. Because the encoding attribute is gone, <gadget> is now parsed as MathML.
4. The gadget is written in such a way that it exploits the parsing differences between HTML and MathML.

Additionally, the gadget can only be written using a tag that is parsed as raw text in HTML. These elements are:

• title
• textarea
• xmp
• iframe
• noembed
• noframes
• plaintext
• noscript
• style
• script

Applications that do not explicitly allow any of these tags should not be affected, since none are allowed by default.

Discovered by: Ivan Ivančić · Date: 2026-06-29 · Found via local differential analysis and source review of ammonia's sanitisation pipeline; no third-party systems were tested.

Affected versions of this crate did not correctly strip namespace-incompatible tags in certain situations, causing it to incorrectly account for differences between HTML, SVG, and MathML.

This vulnerability only has an effect when the svg or math tag is allowed, because it relies on a tag being parsed as html during the cleaning process, but serialized in a way that causes in to be parsed as xml by the browser.

Additionally, the application using this library must allow a tag that is parsed as raw text in HTML. These elements are:

• title
• textarea
• xmp
• iframe
• noembed
• noframes
• plaintext
• noscript
• style
• script

Applications that do not explicitly allow any of these tags should not be affected, since none are allowed by default.

An incorrect mapping from HTML specification to ASCII codes was used. Because HTML treats the Form Feed as whitespace, code like this has an injection bug:

let html = format!("<div title={}>", clean_text(user_supplied_string));

Applications are not affected if they quote their attributes, or if they don't use clean_text at all.

The following SVG will produce a link with a javascript scheme. If the user clicks this link, they will run it.

<svg xmlns="http://www.w3.org/2000/svg">
  <a>
    <set attributeName="href" to="javascript:alert('SET_XSS')"></set>
    <text y="30">Click set</text>
  </a>
</svg>

Ammonia did not apply attribute filters based on attributeName, so the contents of the to, from, and values tags were not sanitized as URLs.

Applications that do not explicitly allow either of these tags should not be affected, since neither are allowed by default.

Discovered by: Younghun Ko (@koyokr)

If a certain set of MathML tags are enabled, an attacker can inject arbitrary JavaScript code into the user's browser.

The annotation-xml tag has slightly different behavior than the other "integration point" tags in MathML and SVG, but ammonia didn't handle it, so it didn't correctly strip the namespace-incompatible tags.

This vulnerability only has an effect when the math and annotation-xml tags are both enabled, but the encoding attribute is disabled, because it relies on the following sequence of steps:

1. User writes code like <math><annotation-xml encoding="text/html"><gadget></annotation-xml></math>.
2. Namespace filtering checks the DOM, and it passes. <gadget> is parsed as HTML.
3. Attribute filter strips it down to <math><annotation-xml><gadget></annotation-xml></math>. Because the encoding attribute is gone, <gadget> is now parsed as MathML.
4. The gadget is written in such a way that it exploits the parsing differences between HTML and MathML.

Additionally, the gadget can only be written using a tag that is parsed as raw text in HTML. These elements are:

• title
• textarea
• xmp
• iframe
• noembed
• noframes
• plaintext
• noscript
• style
• script

Applications that do not explicitly allow any of these tags should not be affected, since none are allowed by default.

Discovered by: Ivan Ivančić · Date: 2026-06-29 · Found via local differential analysis and source review of ammonia's sanitisation pipeline; no third-party systems were tested.

Affected versions of this crate did not correctly strip namespace-incompatible tags in certain situations, causing it to incorrectly account for differences between HTML, SVG, and MathML.

This vulnerability only has an effect when the svg or math tag is allowed, because it relies on a tag being parsed as html during the cleaning process, but serialized in a way that causes in to be parsed as xml by the browser.

Additionally, the application using this library must allow a tag that is parsed as raw text in HTML. These elements are:

• title
• textarea
• xmp
• iframe
• noembed
• noframes
• plaintext
• noscript
• style
• script

Applications that do not explicitly allow any of these tags should not be affected, since none are allowed by default.

An incorrect mapping from HTML specification to ASCII codes was used. Because HTML treats the Form Feed as whitespace, code like this has an injection bug:

let html = format!("<div title={}>", clean_text(user_supplied_string));

Applications are not affected if they quote their attributes, or if they don't use clean_text at all.

An issue was discovered in the ammonia crate before 3.1.0 for Rust. XSS can occur because the parsing differences for HTML, SVG, and MathML are mishandled, a similar issue to CVE-2020-26870.

The following SVG will produce a link with a javascript scheme. If the user clicks this link, they will run it.

<svg xmlns="http://www.w3.org/2000/svg">
  <a>
    <set attributeName="href" to="javascript:alert('SET_XSS')"></set>
    <text y="30">Click set</text>
  </a>
</svg>

Ammonia did not apply attribute filters based on attributeName, so the contents of the to, from, and values tags were not sanitized as URLs.

Applications that do not explicitly allow either of these tags should not be affected, since neither are allowed by default.

Discovered by: Younghun Ko (@koyokr)

If a certain set of MathML tags are enabled, an attacker can inject arbitrary JavaScript code into the user's browser.

The annotation-xml tag has slightly different behavior than the other "integration point" tags in MathML and SVG, but ammonia didn't handle it, so it didn't correctly strip the namespace-incompatible tags.

This vulnerability only has an effect when the math and annotation-xml tags are both enabled, but the encoding attribute is disabled, because it relies on the following sequence of steps:

1. User writes code like <math><annotation-xml encoding="text/html"><gadget></annotation-xml></math>.
2. Namespace filtering checks the DOM, and it passes. <gadget> is parsed as HTML.
3. Attribute filter strips it down to <math><annotation-xml><gadget></annotation-xml></math>. Because the encoding attribute is gone, <gadget> is now parsed as MathML.
4. The gadget is written in such a way that it exploits the parsing differences between HTML and MathML.

Additionally, the gadget can only be written using a tag that is parsed as raw text in HTML. These elements are:

• title
• textarea
• xmp
• iframe
• noembed
• noframes
• plaintext
• noscript
• style
• script

Applications that do not explicitly allow any of these tags should not be affected, since none are allowed by default.

Discovered by: Ivan Ivančić · Date: 2026-06-29 · Found via local differential analysis and source review of ammonia's sanitisation pipeline; no third-party systems were tested.

Affected versions of this crate did not correctly strip namespace-incompatible tags in certain situations, causing it to incorrectly account for differences between HTML, SVG, and MathML.

This vulnerability only has an effect when the svg or math tag is allowed, because it relies on a tag being parsed as html during the cleaning process, but serialized in a way that causes in to be parsed as xml by the browser.

Additionally, the application using this library must allow a tag that is parsed as raw text in HTML. These elements are:

• title
• textarea
• xmp
• iframe
• noembed
• noframes
• plaintext
• noscript
• style
• script

Applications that do not explicitly allow any of these tags should not be affected, since none are allowed by default.

An issue was discovered in the ammonia crate before 3.1.0 for Rust. XSS can occur because the parsing differences for HTML, SVG, and MathML are mishandled, a similar issue to CVE-2020-26870.

The following SVG will produce a link with a javascript scheme. If the user clicks this link, they will run it.

<svg xmlns="http://www.w3.org/2000/svg">
  <a>
    <set attributeName="href" to="javascript:alert('SET_XSS')"></set>
    <text y="30">Click set</text>
  </a>
</svg>

Ammonia did not apply attribute filters based on attributeName, so the contents of the to, from, and values tags were not sanitized as URLs.

Applications that do not explicitly allow either of these tags should not be affected, since neither are allowed by default.

Discovered by: Younghun Ko (@koyokr)

If a certain set of MathML tags are enabled, an attacker can inject arbitrary JavaScript code into the user's browser.

The annotation-xml tag has slightly different behavior than the other "integration point" tags in MathML and SVG, but ammonia didn't handle it, so it didn't correctly strip the namespace-incompatible tags.

This vulnerability only has an effect when the math and annotation-xml tags are both enabled, but the encoding attribute is disabled, because it relies on the following sequence of steps:

1. User writes code like <math><annotation-xml encoding="text/html"><gadget></annotation-xml></math>.
2. Namespace filtering checks the DOM, and it passes. <gadget> is parsed as HTML.
3. Attribute filter strips it down to <math><annotation-xml><gadget></annotation-xml></math>. Because the encoding attribute is gone, <gadget> is now parsed as MathML.
4. The gadget is written in such a way that it exploits the parsing differences between HTML and MathML.

Additionally, the gadget can only be written using a tag that is parsed as raw text in HTML. These elements are:

• title
• textarea
• xmp
• iframe
• noembed
• noframes
• plaintext
• noscript
• style
• script

Applications that do not explicitly allow any of these tags should not be affected, since none are allowed by default.

Discovered by: Ivan Ivančić · Date: 2026-06-29 · Found via local differential analysis and source review of ammonia's sanitisation pipeline; no third-party systems were tested.

Affected versions of this crate did not correctly strip namespace-incompatible tags in certain situations, causing it to incorrectly account for differences between HTML, SVG, and MathML.

This vulnerability only has an effect when the svg or math tag is allowed, because it relies on a tag being parsed as html during the cleaning process, but serialized in a way that causes in to be parsed as xml by the browser.

Additionally, the application using this library must allow a tag that is parsed as raw text in HTML. These elements are:

• title
• textarea
• xmp
• iframe
• noembed
• noframes
• plaintext
• noscript
• style
• script

Applications that do not explicitly allow any of these tags should not be affected, since none are allowed by default.

An issue was discovered in the ammonia crate before 3.1.0 for Rust. XSS can occur because the parsing differences for HTML, SVG, and MathML are mishandled, a similar issue to CVE-2020-26870.

The following SVG will produce a link with a javascript scheme. If the user clicks this link, they will run it.

<svg xmlns="http://www.w3.org/2000/svg">
  <a>
    <set attributeName="href" to="javascript:alert('SET_XSS')"></set>
    <text y="30">Click set</text>
  </a>
</svg>

Ammonia did not apply attribute filters based on attributeName, so the contents of the to, from, and values tags were not sanitized as URLs.

Applications that do not explicitly allow either of these tags should not be affected, since neither are allowed by default.

Discovered by: Younghun Ko (@koyokr)

If a certain set of MathML tags are enabled, an attacker can inject arbitrary JavaScript code into the user's browser.

The annotation-xml tag has slightly different behavior than the other "integration point" tags in MathML and SVG, but ammonia didn't handle it, so it didn't correctly strip the namespace-incompatible tags.

This vulnerability only has an effect when the math and annotation-xml tags are both enabled, but the encoding attribute is disabled, because it relies on the following sequence of steps:

1. User writes code like <math><annotation-xml encoding="text/html"><gadget></annotation-xml></math>.
2. Namespace filtering checks the DOM, and it passes. <gadget> is parsed as HTML.
3. Attribute filter strips it down to <math><annotation-xml><gadget></annotation-xml></math>. Because the encoding attribute is gone, <gadget> is now parsed as MathML.
4. The gadget is written in such a way that it exploits the parsing differences between HTML and MathML.

Additionally, the gadget can only be written using a tag that is parsed as raw text in HTML. These elements are:

• title
• textarea
• xmp
• iframe
• noembed
• noframes
• plaintext
• noscript
• style
• script

Applications that do not explicitly allow any of these tags should not be affected, since none are allowed by default.

Discovered by: Ivan Ivančić · Date: 2026-06-29 · Found via local differential analysis and source review of ammonia's sanitisation pipeline; no third-party systems were tested.

Affected versions of this crate did not correctly strip namespace-incompatible tags in certain situations, causing it to incorrectly account for differences between HTML, SVG, and MathML.

This vulnerability only has an effect when the svg or math tag is allowed, because it relies on a tag being parsed as html during the cleaning process, but serialized in a way that causes in to be parsed as xml by the browser.

Additionally, the application using this library must allow a tag that is parsed as raw text in HTML. These elements are:

• title
• textarea
• xmp
• iframe
• noembed
• noframes
• plaintext
• noscript
• style
• script

Applications that do not explicitly allow any of these tags should not be affected, since none are allowed by default.

An issue was discovered in the ammonia crate before 3.1.0 for Rust. XSS can occur because the parsing differences for HTML, SVG, and MathML are mishandled, a similar issue to CVE-2020-26870.

The following SVG will produce a link with a javascript scheme. If the user clicks this link, they will run it.

<svg xmlns="http://www.w3.org/2000/svg">
  <a>
    <set attributeName="href" to="javascript:alert('SET_XSS')"></set>
    <text y="30">Click set</text>
  </a>
</svg>

Ammonia did not apply attribute filters based on attributeName, so the contents of the to, from, and values tags were not sanitized as URLs.

Applications that do not explicitly allow either of these tags should not be affected, since neither are allowed by default.

Discovered by: Younghun Ko (@koyokr)

If a certain set of MathML tags are enabled, an attacker can inject arbitrary JavaScript code into the user's browser.

The annotation-xml tag has slightly different behavior than the other "integration point" tags in MathML and SVG, but ammonia didn't handle it, so it didn't correctly strip the namespace-incompatible tags.

This vulnerability only has an effect when the math and annotation-xml tags are both enabled, but the encoding attribute is disabled, because it relies on the following sequence of steps:

1. User writes code like <math><annotation-xml encoding="text/html"><gadget></annotation-xml></math>.
2. Namespace filtering checks the DOM, and it passes. <gadget> is parsed as HTML.
3. Attribute filter strips it down to <math><annotation-xml><gadget></annotation-xml></math>. Because the encoding attribute is gone, <gadget> is now parsed as MathML.
4. The gadget is written in such a way that it exploits the parsing differences between HTML and MathML.

Additionally, the gadget can only be written using a tag that is parsed as raw text in HTML. These elements are:

• title
• textarea
• xmp
• iframe
• noembed
• noframes
• plaintext
• noscript
• style
• script

Applications that do not explicitly allow any of these tags should not be affected, since none are allowed by default.

Discovered by: Ivan Ivančić · Date: 2026-06-29 · Found via local differential analysis and source review of ammonia's sanitisation pipeline; no third-party systems were tested.

Affected versions of this crate did not correctly strip namespace-incompatible tags in certain situations, causing it to incorrectly account for differences between HTML, SVG, and MathML.

This vulnerability only has an effect when the svg or math tag is allowed, because it relies on a tag being parsed as html during the cleaning process, but serialized in a way that causes in to be parsed as xml by the browser.

Additionally, the application using this library must allow a tag that is parsed as raw text in HTML. These elements are:

• title
• textarea
• xmp
• iframe
• noembed
• noframes
• plaintext
• noscript
• style
• script

Applications that do not explicitly allow any of these tags should not be affected, since none are allowed by default.

An issue was discovered in the ammonia crate before 3.1.0 for Rust. XSS can occur because the parsing differences for HTML, SVG, and MathML are mishandled, a similar issue to CVE-2020-26870.

An issue was discovered in the ammonia crate before 2.1.0 for Rust. There is uncontrolled recursion during HTML DOM tree serialization.

The following SVG will produce a link with a javascript scheme. If the user clicks this link, they will run it.

<svg xmlns="http://www.w3.org/2000/svg">
  <a>
    <set attributeName="href" to="javascript:alert('SET_XSS')"></set>
    <text y="30">Click set</text>
  </a>
</svg>

Ammonia did not apply attribute filters based on attributeName, so the contents of the to, from, and values tags were not sanitized as URLs.

Applications that do not explicitly allow either of these tags should not be affected, since neither are allowed by default.

Discovered by: Younghun Ko (@koyokr)

If a certain set of MathML tags are enabled, an attacker can inject arbitrary JavaScript code into the user's browser.

The annotation-xml tag has slightly different behavior than the other "integration point" tags in MathML and SVG, but ammonia didn't handle it, so it didn't correctly strip the namespace-incompatible tags.

This vulnerability only has an effect when the math and annotation-xml tags are both enabled, but the encoding attribute is disabled, because it relies on the following sequence of steps:

1. User writes code like <math><annotation-xml encoding="text/html"><gadget></annotation-xml></math>.
2. Namespace filtering checks the DOM, and it passes. <gadget> is parsed as HTML.
3. Attribute filter strips it down to <math><annotation-xml><gadget></annotation-xml></math>. Because the encoding attribute is gone, <gadget> is now parsed as MathML.
4. The gadget is written in such a way that it exploits the parsing differences between HTML and MathML.

Additionally, the gadget can only be written using a tag that is parsed as raw text in HTML. These elements are:

• title
• textarea
• xmp
• iframe
• noembed
• noframes
• plaintext
• noscript
• style
• script

Applications that do not explicitly allow any of these tags should not be affected, since none are allowed by default.

Discovered by: Ivan Ivančić · Date: 2026-06-29 · Found via local differential analysis and source review of ammonia's sanitisation pipeline; no third-party systems were tested.

Affected versions of this crate did not correctly strip namespace-incompatible tags in certain situations, causing it to incorrectly account for differences between HTML, SVG, and MathML.

This vulnerability only has an effect when the svg or math tag is allowed, because it relies on a tag being parsed as html during the cleaning process, but serialized in a way that causes in to be parsed as xml by the browser.

Additionally, the application using this library must allow a tag that is parsed as raw text in HTML. These elements are:

• title
• textarea
• xmp
• iframe
• noembed
• noframes
• plaintext
• noscript
• style
• script

Applications that do not explicitly allow any of these tags should not be affected, since none are allowed by default.

An issue was discovered in the ammonia crate before 3.1.0 for Rust. XSS can occur because the parsing differences for HTML, SVG, and MathML are mishandled, a similar issue to CVE-2020-26870.

An issue was discovered in the ammonia crate before 2.1.0 for Rust. There is uncontrolled recursion during HTML DOM tree serialization.

The following SVG will produce a link with a javascript scheme. If the user clicks this link, they will run it.

<svg xmlns="http://www.w3.org/2000/svg">
  <a>
    <set attributeName="href" to="javascript:alert('SET_XSS')"></set>
    <text y="30">Click set</text>
  </a>
</svg>

Ammonia did not apply attribute filters based on attributeName, so the contents of the to, from, and values tags were not sanitized as URLs.

Applications that do not explicitly allow either of these tags should not be affected, since neither are allowed by default.

Discovered by: Younghun Ko (@koyokr)

If a certain set of MathML tags are enabled, an attacker can inject arbitrary JavaScript code into the user's browser.

The annotation-xml tag has slightly different behavior than the other "integration point" tags in MathML and SVG, but ammonia didn't handle it, so it didn't correctly strip the namespace-incompatible tags.

This vulnerability only has an effect when the math and annotation-xml tags are both enabled, but the encoding attribute is disabled, because it relies on the following sequence of steps:

1. User writes code like <math><annotation-xml encoding="text/html"><gadget></annotation-xml></math>.
2. Namespace filtering checks the DOM, and it passes. <gadget> is parsed as HTML.
3. Attribute filter strips it down to <math><annotation-xml><gadget></annotation-xml></math>. Because the encoding attribute is gone, <gadget> is now parsed as MathML.
4. The gadget is written in such a way that it exploits the parsing differences between HTML and MathML.

Additionally, the gadget can only be written using a tag that is parsed as raw text in HTML. These elements are:

• title
• textarea
• xmp
• iframe
• noembed
• noframes
• plaintext
• noscript
• style
• script

Applications that do not explicitly allow any of these tags should not be affected, since none are allowed by default.

Discovered by: Ivan Ivančić · Date: 2026-06-29 · Found via local differential analysis and source review of ammonia's sanitisation pipeline; no third-party systems were tested.

Affected versions of this crate did not correctly strip namespace-incompatible tags in certain situations, causing it to incorrectly account for differences between HTML, SVG, and MathML.

This vulnerability only has an effect when the svg or math tag is allowed, because it relies on a tag being parsed as html during the cleaning process, but serialized in a way that causes in to be parsed as xml by the browser.

Additionally, the application using this library must allow a tag that is parsed as raw text in HTML. These elements are:

• title
• textarea
• xmp
• iframe
• noembed
• noframes
• plaintext
• noscript
• style
• script

Applications that do not explicitly allow any of these tags should not be affected, since none are allowed by default.

An issue was discovered in the ammonia crate before 3.1.0 for Rust. XSS can occur because the parsing differences for HTML, SVG, and MathML are mishandled, a similar issue to CVE-2020-26870.

An issue was discovered in the ammonia crate before 2.1.0 for Rust. There is uncontrolled recursion during HTML DOM tree serialization.

The following SVG will produce a link with a javascript scheme. If the user clicks this link, they will run it.

<svg xmlns="http://www.w3.org/2000/svg">
  <a>
    <set attributeName="href" to="javascript:alert('SET_XSS')"></set>
    <text y="30">Click set</text>
  </a>
</svg>

Ammonia did not apply attribute filters based on attributeName, so the contents of the to, from, and values tags were not sanitized as URLs.

Applications that do not explicitly allow either of these tags should not be affected, since neither are allowed by default.

Discovered by: Younghun Ko (@koyokr)

If a certain set of MathML tags are enabled, an attacker can inject arbitrary JavaScript code into the user's browser.

The annotation-xml tag has slightly different behavior than the other "integration point" tags in MathML and SVG, but ammonia didn't handle it, so it didn't correctly strip the namespace-incompatible tags.

This vulnerability only has an effect when the math and annotation-xml tags are both enabled, but the encoding attribute is disabled, because it relies on the following sequence of steps:

1. User writes code like <math><annotation-xml encoding="text/html"><gadget></annotation-xml></math>.
2. Namespace filtering checks the DOM, and it passes. <gadget> is parsed as HTML.
3. Attribute filter strips it down to <math><annotation-xml><gadget></annotation-xml></math>. Because the encoding attribute is gone, <gadget> is now parsed as MathML.
4. The gadget is written in such a way that it exploits the parsing differences between HTML and MathML.

Additionally, the gadget can only be written using a tag that is parsed as raw text in HTML. These elements are:

• title
• textarea
• xmp
• iframe
• noembed
• noframes
• plaintext
• noscript
• style
• script

Applications that do not explicitly allow any of these tags should not be affected, since none are allowed by default.

Discovered by: Ivan Ivančić · Date: 2026-06-29 · Found via local differential analysis and source review of ammonia's sanitisation pipeline; no third-party systems were tested.

Affected versions of this crate did not correctly strip namespace-incompatible tags in certain situations, causing it to incorrectly account for differences between HTML, SVG, and MathML.

This vulnerability only has an effect when the svg or math tag is allowed, because it relies on a tag being parsed as html during the cleaning process, but serialized in a way that causes in to be parsed as xml by the browser.

Additionally, the application using this library must allow a tag that is parsed as raw text in HTML. These elements are:

• title
• textarea
• xmp
• iframe
• noembed
• noframes
• plaintext
• noscript
• style
• script

Applications that do not explicitly allow any of these tags should not be affected, since none are allowed by default.

An issue was discovered in the ammonia crate before 3.1.0 for Rust. XSS can occur because the parsing differences for HTML, SVG, and MathML are mishandled, a similar issue to CVE-2020-26870.

An issue was discovered in the ammonia crate before 2.1.0 for Rust. There is uncontrolled recursion during HTML DOM tree serialization.

The following SVG will produce a link with a javascript scheme. If the user clicks this link, they will run it.

<svg xmlns="http://www.w3.org/2000/svg">
  <a>
    <set attributeName="href" to="javascript:alert('SET_XSS')"></set>
    <text y="30">Click set</text>
  </a>
</svg>

Ammonia did not apply attribute filters based on attributeName, so the contents of the to, from, and values tags were not sanitized as URLs.

Applications that do not explicitly allow either of these tags should not be affected, since neither are allowed by default.

Discovered by: Younghun Ko (@koyokr)

If a certain set of MathML tags are enabled, an attacker can inject arbitrary JavaScript code into the user's browser.

The annotation-xml tag has slightly different behavior than the other "integration point" tags in MathML and SVG, but ammonia didn't handle it, so it didn't correctly strip the namespace-incompatible tags.

This vulnerability only has an effect when the math and annotation-xml tags are both enabled, but the encoding attribute is disabled, because it relies on the following sequence of steps:

1. User writes code like <math><annotation-xml encoding="text/html"><gadget></annotation-xml></math>.
2. Namespace filtering checks the DOM, and it passes. <gadget> is parsed as HTML.
3. Attribute filter strips it down to <math><annotation-xml><gadget></annotation-xml></math>. Because the encoding attribute is gone, <gadget> is now parsed as MathML.
4. The gadget is written in such a way that it exploits the parsing differences between HTML and MathML.

Additionally, the gadget can only be written using a tag that is parsed as raw text in HTML. These elements are:

• title
• textarea
• xmp
• iframe
• noembed
• noframes
• plaintext
• noscript
• style
• script

Applications that do not explicitly allow any of these tags should not be affected, since none are allowed by default.

Discovered by: Ivan Ivančić · Date: 2026-06-29 · Found via local differential analysis and source review of ammonia's sanitisation pipeline; no third-party systems were tested.

Affected versions of this crate did not correctly strip namespace-incompatible tags in certain situations, causing it to incorrectly account for differences between HTML, SVG, and MathML.

This vulnerability only has an effect when the svg or math tag is allowed, because it relies on a tag being parsed as html during the cleaning process, but serialized in a way that causes in to be parsed as xml by the browser.

Additionally, the application using this library must allow a tag that is parsed as raw text in HTML. These elements are:

• title
• textarea
• xmp
• iframe
• noembed
• noframes
• plaintext
• noscript
• style
• script

Applications that do not explicitly allow any of these tags should not be affected, since none are allowed by default.

An issue was discovered in the ammonia crate before 3.1.0 for Rust. XSS can occur because the parsing differences for HTML, SVG, and MathML are mishandled, a similar issue to CVE-2020-26870.

An issue was discovered in the ammonia crate before 2.1.0 for Rust. There is uncontrolled recursion during HTML DOM tree serialization.

The following SVG will produce a link with a javascript scheme. If the user clicks this link, they will run it.

<svg xmlns="http://www.w3.org/2000/svg">
  <a>
    <set attributeName="href" to="javascript:alert('SET_XSS')"></set>
    <text y="30">Click set</text>
  </a>
</svg>

Ammonia did not apply attribute filters based on attributeName, so the contents of the to, from, and values tags were not sanitized as URLs.

Applications that do not explicitly allow either of these tags should not be affected, since neither are allowed by default.

Discovered by: Younghun Ko (@koyokr)

If a certain set of MathML tags are enabled, an attacker can inject arbitrary JavaScript code into the user's browser.

The annotation-xml tag has slightly different behavior than the other "integration point" tags in MathML and SVG, but ammonia didn't handle it, so it didn't correctly strip the namespace-incompatible tags.

This vulnerability only has an effect when the math and annotation-xml tags are both enabled, but the encoding attribute is disabled, because it relies on the following sequence of steps:

1. User writes code like <math><annotation-xml encoding="text/html"><gadget></annotation-xml></math>.
2. Namespace filtering checks the DOM, and it passes. <gadget> is parsed as HTML.
3. Attribute filter strips it down to <math><annotation-xml><gadget></annotation-xml></math>. Because the encoding attribute is gone, <gadget> is now parsed as MathML.
4. The gadget is written in such a way that it exploits the parsing differences between HTML and MathML.

Additionally, the gadget can only be written using a tag that is parsed as raw text in HTML. These elements are:

• title
• textarea
• xmp
• iframe
• noembed
• noframes
• plaintext
• noscript
• style
• script

Applications that do not explicitly allow any of these tags should not be affected, since none are allowed by default.

Discovered by: Ivan Ivančić · Date: 2026-06-29 · Found via local differential analysis and source review of ammonia's sanitisation pipeline; no third-party systems were tested.

Affected versions of this crate did not correctly strip namespace-incompatible tags in certain situations, causing it to incorrectly account for differences between HTML, SVG, and MathML.

This vulnerability only has an effect when the svg or math tag is allowed, because it relies on a tag being parsed as html during the cleaning process, but serialized in a way that causes in to be parsed as xml by the browser.

Additionally, the application using this library must allow a tag that is parsed as raw text in HTML. These elements are:

• title
• textarea
• xmp
• iframe
• noembed
• noframes
• plaintext
• noscript
• style
• script

Applications that do not explicitly allow any of these tags should not be affected, since none are allowed by default.

An issue was discovered in the ammonia crate before 3.1.0 for Rust. XSS can occur because the parsing differences for HTML, SVG, and MathML are mishandled, a similar issue to CVE-2020-26870.

An issue was discovered in the ammonia crate before 2.1.0 for Rust. There is uncontrolled recursion during HTML DOM tree serialization.

The following SVG will produce a link with a javascript scheme. If the user clicks this link, they will run it.

<svg xmlns="http://www.w3.org/2000/svg">
  <a>
    <set attributeName="href" to="javascript:alert('SET_XSS')"></set>
    <text y="30">Click set</text>
  </a>
</svg>

Ammonia did not apply attribute filters based on attributeName, so the contents of the to, from, and values tags were not sanitized as URLs.

Applications that do not explicitly allow either of these tags should not be affected, since neither are allowed by default.

Discovered by: Younghun Ko (@koyokr)

If a certain set of MathML tags are enabled, an attacker can inject arbitrary JavaScript code into the user's browser.

The annotation-xml tag has slightly different behavior than the other "integration point" tags in MathML and SVG, but ammonia didn't handle it, so it didn't correctly strip the namespace-incompatible tags.

This vulnerability only has an effect when the math and annotation-xml tags are both enabled, but the encoding attribute is disabled, because it relies on the following sequence of steps:

1. User writes code like <math><annotation-xml encoding="text/html"><gadget></annotation-xml></math>.
2. Namespace filtering checks the DOM, and it passes. <gadget> is parsed as HTML.
3. Attribute filter strips it down to <math><annotation-xml><gadget></annotation-xml></math>. Because the encoding attribute is gone, <gadget> is now parsed as MathML.
4. The gadget is written in such a way that it exploits the parsing differences between HTML and MathML.

Additionally, the gadget can only be written using a tag that is parsed as raw text in HTML. These elements are:

• title
• textarea
• xmp
• iframe
• noembed
• noframes
• plaintext
• noscript
• style
• script

Applications that do not explicitly allow any of these tags should not be affected, since none are allowed by default.

Discovered by: Ivan Ivančić · Date: 2026-06-29 · Found via local differential analysis and source review of ammonia's sanitisation pipeline; no third-party systems were tested.

Affected versions of this crate did not correctly strip namespace-incompatible tags in certain situations, causing it to incorrectly account for differences between HTML, SVG, and MathML.

This vulnerability only has an effect when the svg or math tag is allowed, because it relies on a tag being parsed as html during the cleaning process, but serialized in a way that causes in to be parsed as xml by the browser.

Additionally, the application using this library must allow a tag that is parsed as raw text in HTML. These elements are:

• title
• textarea
• xmp
• iframe
• noembed
• noframes
• plaintext
• noscript
• style
• script

Applications that do not explicitly allow any of these tags should not be affected, since none are allowed by default.

An issue was discovered in the ammonia crate before 3.1.0 for Rust. XSS can occur because the parsing differences for HTML, SVG, and MathML are mishandled, a similar issue to CVE-2020-26870.

An issue was discovered in the ammonia crate before 2.1.0 for Rust. There is uncontrolled recursion during HTML DOM tree serialization.

The following SVG will produce a link with a javascript scheme. If the user clicks this link, they will run it.

<svg xmlns="http://www.w3.org/2000/svg">
  <a>
    <set attributeName="href" to="javascript:alert('SET_XSS')"></set>
    <text y="30">Click set</text>
  </a>
</svg>

Ammonia did not apply attribute filters based on attributeName, so the contents of the to, from, and values tags were not sanitized as URLs.

Applications that do not explicitly allow either of these tags should not be affected, since neither are allowed by default.

Discovered by: Younghun Ko (@koyokr)

If a certain set of MathML tags are enabled, an attacker can inject arbitrary JavaScript code into the user's browser.

The annotation-xml tag has slightly different behavior than the other "integration point" tags in MathML and SVG, but ammonia didn't handle it, so it didn't correctly strip the namespace-incompatible tags.

This vulnerability only has an effect when the math and annotation-xml tags are both enabled, but the encoding attribute is disabled, because it relies on the following sequence of steps:

1. User writes code like <math><annotation-xml encoding="text/html"><gadget></annotation-xml></math>.
2. Namespace filtering checks the DOM, and it passes. <gadget> is parsed as HTML.
3. Attribute filter strips it down to <math><annotation-xml><gadget></annotation-xml></math>. Because the encoding attribute is gone, <gadget> is now parsed as MathML.
4. The gadget is written in such a way that it exploits the parsing differences between HTML and MathML.

Additionally, the gadget can only be written using a tag that is parsed as raw text in HTML. These elements are:

• title
• textarea
• xmp
• iframe
• noembed
• noframes
• plaintext
• noscript
• style
• script

Applications that do not explicitly allow any of these tags should not be affected, since none are allowed by default.

Discovered by: Ivan Ivančić · Date: 2026-06-29 · Found via local differential analysis and source review of ammonia's sanitisation pipeline; no third-party systems were tested.

Affected versions of this crate did not correctly strip namespace-incompatible tags in certain situations, causing it to incorrectly account for differences between HTML, SVG, and MathML.

This vulnerability only has an effect when the svg or math tag is allowed, because it relies on a tag being parsed as html during the cleaning process, but serialized in a way that causes in to be parsed as xml by the browser.

Additionally, the application using this library must allow a tag that is parsed as raw text in HTML. These elements are:

• title
• textarea
• xmp
• iframe
• noembed
• noframes
• plaintext
• noscript
• style
• script

Applications that do not explicitly allow any of these tags should not be affected, since none are allowed by default.

An issue was discovered in the ammonia crate before 3.1.0 for Rust. XSS can occur because the parsing differences for HTML, SVG, and MathML are mishandled, a similar issue to CVE-2020-26870.

An issue was discovered in the ammonia crate before 2.1.0 for Rust. There is uncontrolled recursion during HTML DOM tree serialization.

The following SVG will produce a link with a javascript scheme. If the user clicks this link, they will run it.

<svg xmlns="http://www.w3.org/2000/svg">
  <a>
    <set attributeName="href" to="javascript:alert('SET_XSS')"></set>
    <text y="30">Click set</text>
  </a>
</svg>

Ammonia did not apply attribute filters based on attributeName, so the contents of the to, from, and values tags were not sanitized as URLs.

Applications that do not explicitly allow either of these tags should not be affected, since neither are allowed by default.

Discovered by: Younghun Ko (@koyokr)

If a certain set of MathML tags are enabled, an attacker can inject arbitrary JavaScript code into the user's browser.

The annotation-xml tag has slightly different behavior than the other "integration point" tags in MathML and SVG, but ammonia didn't handle it, so it didn't correctly strip the namespace-incompatible tags.

This vulnerability only has an effect when the math and annotation-xml tags are both enabled, but the encoding attribute is disabled, because it relies on the following sequence of steps:

1. User writes code like <math><annotation-xml encoding="text/html"><gadget></annotation-xml></math>.
2. Namespace filtering checks the DOM, and it passes. <gadget> is parsed as HTML.
3. Attribute filter strips it down to <math><annotation-xml><gadget></annotation-xml></math>. Because the encoding attribute is gone, <gadget> is now parsed as MathML.
4. The gadget is written in such a way that it exploits the parsing differences between HTML and MathML.

Additionally, the gadget can only be written using a tag that is parsed as raw text in HTML. These elements are:

• title
• textarea
• xmp
• iframe
• noembed
• noframes
• plaintext
• noscript
• style
• script

Applications that do not explicitly allow any of these tags should not be affected, since none are allowed by default.

Discovered by: Ivan Ivančić · Date: 2026-06-29 · Found via local differential analysis and source review of ammonia's sanitisation pipeline; no third-party systems were tested.

Affected versions of this crate did not correctly strip namespace-incompatible tags in certain situations, causing it to incorrectly account for differences between HTML, SVG, and MathML.

This vulnerability only has an effect when the svg or math tag is allowed, because it relies on a tag being parsed as html during the cleaning process, but serialized in a way that causes in to be parsed as xml by the browser.

Additionally, the application using this library must allow a tag that is parsed as raw text in HTML. These elements are:

• title
• textarea
• xmp
• iframe
• noembed
• noframes
• plaintext
• noscript
• style
• script

Applications that do not explicitly allow any of these tags should not be affected, since none are allowed by default.

An issue was discovered in the ammonia crate before 3.1.0 for Rust. XSS can occur because the parsing differences for HTML, SVG, and MathML are mishandled, a similar issue to CVE-2020-26870.

An issue was discovered in the ammonia crate before 2.1.0 for Rust. There is uncontrolled recursion during HTML DOM tree serialization.

The following SVG will produce a link with a javascript scheme. If the user clicks this link, they will run it.

<svg xmlns="http://www.w3.org/2000/svg">
  <a>
    <set attributeName="href" to="javascript:alert('SET_XSS')"></set>
    <text y="30">Click set</text>
  </a>
</svg>

Ammonia did not apply attribute filters based on attributeName, so the contents of the to, from, and values tags were not sanitized as URLs.

Applications that do not explicitly allow either of these tags should not be affected, since neither are allowed by default.

Discovered by: Younghun Ko (@koyokr)

If a certain set of MathML tags are enabled, an attacker can inject arbitrary JavaScript code into the user's browser.

The annotation-xml tag has slightly different behavior than the other "integration point" tags in MathML and SVG, but ammonia didn't handle it, so it didn't correctly strip the namespace-incompatible tags.

This vulnerability only has an effect when the math and annotation-xml tags are both enabled, but the encoding attribute is disabled, because it relies on the following sequence of steps:

1. User writes code like <math><annotation-xml encoding="text/html"><gadget></annotation-xml></math>.
2. Namespace filtering checks the DOM, and it passes. <gadget> is parsed as HTML.
3. Attribute filter strips it down to <math><annotation-xml><gadget></annotation-xml></math>. Because the encoding attribute is gone, <gadget> is now parsed as MathML.
4. The gadget is written in such a way that it exploits the parsing differences between HTML and MathML.

Additionally, the gadget can only be written using a tag that is parsed as raw text in HTML. These elements are:

• title
• textarea
• xmp
• iframe
• noembed
• noframes
• plaintext
• noscript
• style
• script

Applications that do not explicitly allow any of these tags should not be affected, since none are allowed by default.

Discovered by: Ivan Ivančić · Date: 2026-06-29 · Found via local differential analysis and source review of ammonia's sanitisation pipeline; no third-party systems were tested.

Affected versions of this crate did not correctly strip namespace-incompatible tags in certain situations, causing it to incorrectly account for differences between HTML, SVG, and MathML.

This vulnerability only has an effect when the svg or math tag is allowed, because it relies on a tag being parsed as html during the cleaning process, but serialized in a way that causes in to be parsed as xml by the browser.

Additionally, the application using this library must allow a tag that is parsed as raw text in HTML. These elements are:

• title
• textarea
• xmp
• iframe
• noembed
• noframes
• plaintext
• noscript
• style
• script

Applications that do not explicitly allow any of these tags should not be affected, since none are allowed by default.

An issue was discovered in the ammonia crate before 3.1.0 for Rust. XSS can occur because the parsing differences for HTML, SVG, and MathML are mishandled, a similar issue to CVE-2020-26870.