ammonia: mXSS via MathML `annotation-xml` encoding strip

影響: rust:ammonia < 3.3.2 → 3.3.2, rust:ammonia >= 4.0.0, < 4.0.2 → 4.0.2, rust:ammonia >= 4.1.0, < 4.1.3 → 4.1.3

If a certain set of MathML tags are enabled, an attacker can inject arbitrary JavaScript code into the user's browser. The annotation-xml tag has slightly different behavior than the other "integration point" tags in MathML and SVG, but ammonia didn't handle it, so it didn't correctly strip the namespace-incompatible tags. This vulnerability only has an effect when the math and annotation-xml tags are both enabled, but the encoding attribute is disabled, because it relies on the following seque…

GitHub Advisory Database에서 읽기

2026. 10. 22. 오후 11:06, GitHub Advisory Database에서 "ammonia: mXSS via MathML `annotation-xml` encoding strip"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "보통"(medium)입니다. 관련 기술: Rust. CVE: CVE-2026-63430.