GHSA-m6mh-2hw2-555x: XSS
The following SVG will produce a link with a javascript scheme. If the user clicks this link, they will run it.
svg <svg xmlns="http://www.w3.org/2000/svg"> <a> <set attributeName="href" to="javascript:alert('SETXSS')"></set> <text y="30">Click set</text> </a> </svg>
Impact
Allows stored XSS in applications that allow the animate and set tags.
Patches
Fixed in 3.3.3, 4.0.3, and 4.1.4
Workarounds
Do not enable the animate or set tags.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rust/ammoniato a version that resolves this vulnerability.Fixed in 4.1.4 - Upgrade
Upgrade
rust/ammoniato a version that resolves this vulnerability.Fixed in 4.0.3 - Upgrade
Upgrade
rust/ammoniato a version that resolves this vulnerability.Fixed in 3.3.3 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.3.3 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.0.3 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.1.4 - Configuration
Do not enable the SVG animate or set tags.
Applications allowing SVG animate/set tags animate and set tags = disabled
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Applications using rust/ammonia are exposed when they permit SVG content and enable the SVG animate or set tags. The issue can allow stored cross-site scripting in that configuration.
What must an attacker do to exploit it?
An attacker needs the ability to store SVG content that includes an animate or set element. Exploitation also requires a user to click the resulting SVG link, which can be assigned a javascript scheme.
Are default configurations affected?
The provided information identifies exposure specifically when the animate or set tags are enabled. It does not state whether those tags are enabled by default.
What can be done if upgrading is not immediately possible?
Do not enable the animate or set SVG tags. This removes the conditions identified for the stored XSS issue.
Which versions contain fixes?
The issue is fixed in versions 3.3.3, 4.0.3, and 4.1.4.