CVE-2026-102342

5.4Medium

Published 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

5.4Medium

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: Required
Impact: Limited impact
Weakness: CWE-79

Impact

Attackers can execute arbitrary JavaScript in a victim's browser if the victim clicks a malicious link in sanitized SVG content. This requires an attacker to store malicious HTML/SVG in an application that allows SVG 'animate' or 'set' tags.

Root cause

The sanitizer fails to block javascript: URI schemes inside the 'value' attribute of SVG 'animate' or 'set' elements targeting 'href'.

Affected systems

ammonia prior to versions 3.3.3, 4.0.3, and 4.1.4

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Fix & remediation

Upgrade the ammonia dependency to 3.3.3, 4.0.3, 4.1.4, or later. If upgrading must wait, disallow or strip SVG 'animate' and 'set' elements in your sanitizer configuration.

shell

$ cargo update -p ammonia

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

ammonia is a Rust library for repairing and securing untrusted HTML. Prior to 3.3.3, 4.0.3, and 4.1.4, applications that allow the SVG animate or set elements can retain an animation whose attributeName targets href and whose value uses the javascript scheme. The sanitized SVG can therefore create a script-bearing link, and a user who clicks the link can execute attacker-controlled script in the application's origin, enabling stored cross-site scripting. This issue is fixed in versions 3.3.3, 4.0.3, and 4.1.4.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-102342