Skip to main content
cve.nowby Sazabi
← crates.io
crates.ioPackage

ammonia

4 known vulnerabilities (2 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
4 · 2 medium
Registry
crates.io

Advisories 4

  • CVE-2026-63430Medium 6.3

    ammonia: mXSS in ammonia via MathML `annotation-xml` encoding strip

    Affected: fixed in 3.3.2; from 4.0.0, fixed in 4.0.2; from 4.1.0, fixed in 4.1.3; fixed in 3.3.2; from 4.0.0, fixed in 4.0.2; from 4.1.0, fixed in 4.1.3.

  • CVE-2026-102342Medium 5.4

    ammonia allows stored XSS through unsanitized SVG animate and set attributes

    Affected: fixed in 3.3.3; from 4.0.0, fixed in 4.0.3; from 4.1.2, fixed in 4.1.4; fixed in 3.3.3; from 4.0.0, fixed in 4.0.3; from 4.1.0, fixed in 4.1.4.

  • An issue was discovered in the ammonia crate before 3.1.0 for Rust.

    Affected: fixed in 2.1.3; from 3.0.0, fixed in 3.1.0; from 3.0.0, fixed in 3.1.0; fixed in 2.1.3.

  • An issue was discovered in the ammonia crate before 2.1.0 for Rust.

    Affected: fixed in 2.1.0; fixed in 2.1.0.