CVE-2026-102342: XSS
The following SVG will produce a link with a javascript scheme. If the user clicks this link, they will run it.
svg <svg xmlns="http://www.w3.org/2000/svg"> <a> <set attributeName="href" to="javascript:alert('SETXSS')"></set> <text y="30">Click set</text> </a> </svg>
Impact
Allows stored XSS in applications that allow the animate and set tags.
Patches
Fixed in 3.3.3, 4.0.3, and 4.1.4
Workarounds
Do not enable the animate or set tags.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rust/ammoniato a version that resolves this vulnerability.Fixed in 4.1.4 - Upgrade
Upgrade
rust/ammoniato a version that resolves this vulnerability.Fixed in 4.0.3 - Upgrade
Upgrade
rust/ammoniato a version that resolves this vulnerability.Fixed in 3.3.3 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.3.3 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.0.3 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.1.4 - Configuration
Do not enable the animate or set tags.
animate and set tags = disabled
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Applications using rust/ammonia are exposed when they allow attacker-controlled SVG content and have the SVG animate or set tags enabled. The impact is stored XSS through an SVG link whose href is set to a javascript scheme.
What must an attacker and victim do for exploitation to succeed?
An attacker must be able to store SVG content containing a set element that assigns a javascript URL to a link. A user must then click the resulting link for the JavaScript to run.
Which versions contain fixes?
The issue is fixed in versions 3.3.3, 4.0.3, and 4.1.4.
What can be done if upgrading is not immediately possible?
Do not enable the animate or set SVG tags. This removes the tag capability required by the described exploit.