Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
7 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
If a certain set of MathML tags are enabled, an attacker can inject arbitrary JavaScript code into the user's browser. The annotation-xml tag has slightly different behavior than the other "integration point" tags in MathML and SVG, but ammonia didn't handle it, so it didn't correctly strip the namespace-incompatible tags. This vulnerability only has an effect when the math and annotation-xml tags are both enabled, but the encoding attribute is disabled, because it relies on the following sequence of steps: 1. User writes code like <math<annotation-xml encoding="text/html"<gadget</annotation-xml</math. 2. Namespace filtering checks the DOM, and it passes. <gadget is parsed as HTML. 3. Attribute filter strips it down to <math<annotation-xml<gadget</annotation-xml</math. Because the encoding attribute is gone, <gadget is now parsed as MathML. 4. The gadget is written in such a way that it exploits the parsing differences between HTML and MathML. Additionally, the gadget can only be…
Recommended action: Upgrade to 4.1.3, 4.0.2 or 3.3.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
URL filtering, such as relative URLs and URL scheme limits, is not always applied when CSS sanitization is used. When the inner URL is quoted, CSS `url("")` is matched case-sensitively, when it should be matched case-insensitively. As a result, while `url("")` gets the intended domain name filtering, `URL("")` does not. The following example shows how an application needs to be configured to trigger this bug. ```rust let mut builder = Builder::new(); // allow inline styles builder.filter_style_properties(hashset!["background-image"]); builder.add_generic_attributes(&["style"]); // notice that "http" URLs aren't allowed builder.url_schemes(["cid"].into()); // attacker-controlled, presumably let cleaned = builder.clean(r#" "#); // this is the expected result assert_eq!(String::from(&cleaned), r#" ok "#); // this is the result that the vulnerable version actually gets assert_eq!(String::from(&cleaned), r#" ok "#); ``` This can be used to inject tracking pixels where the application…
Recommended action: Upgrade to 4.2.4 or 4.1.8 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The following SVG will produce a link with a `javascript` scheme. If the user clicks this link, they will run it. ```svg Click set ``` Impact Allows stored XSS in applications that allow the `animate` and `set` tags. Patches Fixed in 3.3.3, 4.0.3, and 4.1.4 Workarounds Do not enable the `animate` or `set` tags.
Recommended action: Upgrade to 4.1.4, 4.0.3 or 3.3.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Affected versions of this crate did not correctly strip namespace-incompatible tags in certain situations, causing it to incorrectly account for differences between HTML, SVG, and MathML. This vulnerability only has an effect when the svg or math tag is allowed, because it relies on a tag being parsed as html during the cleaning process, but serialized in a way that causes in to be parsed as xml by the browser. Additionally, the application using this library must allow a tag that is parsed as raw text in HTML. These [elements] are: title textarea xmp iframe noembed noframes plaintext noscript style script Applications that do not explicitly allow any of these tags should not be affected, since none are allowed by default. [elements]: https://github.com/servo/html5ever/blob/57eb334c0ffccc6f88d563419f0fbeef6ff5741c/html5ever/src/treebuilder/rules.rs
Recommended action: Upgrade to 4.1.2, 4.0.1 or 3.3.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An incorrect mapping from HTML specification to ASCII codes was used. Because HTML treats the Form Feed as whitespace, code like this has an injection bug: let html = format!("<div title={}", cleantext(usersuppliedstring)); Applications are not affected if they quote their attributes, or if they don't use cleantext at all.
Recommended action: Upgrade to 3.1.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An issue was discovered in the ammonia crate before 3.1.0 for Rust. XSS can occur because the parsing differences for HTML, SVG, and MathML are mishandled, a similar issue to CVE-2020-26870.
Recommended action: Upgrade to 3.1.0 or 2.1.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An issue was discovered in the ammonia crate before 2.1.0 for Rust. There is uncontrolled recursion during HTML DOM tree serialization.
Recommended action: Upgrade to 2.1.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.