GitHub Advisoryadvisory · crates.io

GHSA-5325-xw5m-phm3 Cross-site Scripting in ammonia

MEDIUM Published 2021-08-25 Modified 2021-08-18 Official page ↗
Aliases
CVE-2021-38193
Ecosystem
crates.io
Packages
ammonia
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2021-08-18

Affected packages

• crates.io ammonia: >= 3.0.0, < 3.1.0 → fixed in 3.1.0 • crates.io ammonia: < 2.1.3 → fixed in 2.1.3

Description

An issue was discovered in the ammonia crate before 3.1.0 for Rust. XSS can occur because the parsing differences for HTML, SVG, and MathML are mishandled, a similar issue to CVE-2020-26870.

Related

Alias · CVE (1)

  • CVE-2021-38193 An issue was discovered in the ammonia crate before 3.1.0 for Rust. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References