{"id":"ghsa-ghsa-9jh8-v38h-cvhr","seq":309604,"kind":"advisory","title":"ammonia: mXSS  via MathML `annotation-xml` encoding strip","url":"https://github.com/advisories/GHSA-9jh8-v38h-cvhr","permalink":"https://vulnpulse.app/items/ghsa-ghsa-9jh8-v38h-cvhr","summary":"影響: rust:ammonia < 3.3.2 → 3.3.2, rust:ammonia >= 4.0.0, < 4.0.2 → 4.0.2, rust:ammonia >= 4.1.0, < 4.1.3 → 4.1.3\nIf a certain set of MathML tags are enabled, an attacker can inject arbitrary JavaScript code into the user's browser. The annotation-xml tag has slightly different behavior than the other \"integration point\" tags in MathML and SVG, but ammonia didn't handle it, so it didn't correctly strip the namespace-incompatible tags. This vulnerability only has an effect when the math and annotation-xml tags are both enabled, but the encoding attribute is disabled, because it relies on the following seque…","severity":"medium","techs":["rust"],"cves":["CVE-2026-63430"],"tags":["GHSA-9jh8-v38h-cvhr","ammonia","ammonia","ammonia"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-22T14:06:10.000Z","fetched_at":"2026-10-22T20:09:55.169Z"}