9 results · Feed
-
Unscored —
Missing case-insensitive matching for CSS url function
URL filtering, such as relative URLs and URL scheme limits, is not always applied when CSS sanitization is used. When the inner URL is quoted, CSS `url("")` is matched case-sensitively, when it should be matched case-insensitively. As a result, while `url("")…
-
Medium 6.3
ammonia: mXSS in ammonia via MathML `annotation-xml` encoding strip
ammonia is a Rust library for repairing and securing untrusted HTML. Prior to 3.3.2, 4.0.2, and 4.1.3, applications that explicitly allow the math tag, annotation-xml, and at least one raw-text HTML element while disallowing the encoding attribute can permit …
-
Medium 5.4
ammonia allows stored XSS through unsanitized SVG animate and set attributes
ammonia is a Rust library for repairing and securing untrusted HTML. Prior to 3.3.3, 4.0.3, and 4.1.4, applications that allow the SVG animate or set elements can retain an animation whose attributeName targets href and whose value uses the javascript scheme.…
-
Low —
Ammonia incorrectly handles embedded SVG and MathML leading to mutation XSS after removal
Affected versions of this crate did not correctly strip namespace-incompatible tags in certain situations, causing it to incorrectly account for differences between HTML, SVG, and MathML. This vulnerability only has an effect when the `svg` or `math` tag is a…
-
Medium —
Space bug in `clean_text`
An incorrect mapping from HTML specification to ASCII codes was used. Because HTML treats the Form Feed as whitespace, code like this has an injection bug: let html = format!("<div title={}>", clean_text(user_supplied_string)); Applications are not affected i…
-
Unscored —
XSS in ammonia via SVG `animateMotion`, `animateTransform`, and/or `animateColor` tags
The neutralization that ammonia applied to `animate` and `set` was not applied to other forms of SVG animation, which can be used for XSS. The following SVG will produce a link with a javascript scheme. If the user clicks this link, they will run it. ```xml <…
-
Unscored —
Incorrect escaping for `url("")` functions in CSS style attributes
In some cases, quotation marks in CSS url() functions are not escaped. This allows CSS injection. This feature is not enabled by default, so an application is vulnerable if, and only if, the style attribute is allowed and filter_style_properties is used. As a…
-
Medium 6.1
Cross-site Scripting in ammonia
An issue was discovered in the ammonia crate before 3.1.0 for Rust. XSS can occur because the parsing differences for HTML, SVG, and MathML are mishandled, a similar issue to CVE-2020-26870.
-
High 7.5
Uncontrolled recursion in ammonia
An issue was discovered in the ammonia crate before 2.1.0 for Rust. There is uncontrolled recursion during HTML DOM tree serialization.