RUSTSEC-2026-0533: Incorrect handling of embedded SVG and MathML leads to mutation XSS
The MathML text integration points (mi, mo, mn, ms, mtext) and SVG foreignObject can be made to contain a tag in the other one's namespace (a MathML integration point with a child in the SVG namespace, or vice versa) without the root tag that switches out of the HTML namespace. If the attacker can construct input that parses differently in as HTML than as foreign XML, they can inject arbitrary JavaScript code into the user's browser.
For example:
- The user writes <math><mi><svg><gadget></svg></mi></math>. - The application enables math, mi, and the gadget, but not svg. - Ammonia filters the input to <math><mi><gadget></mi></math>. - Because svg is now gone, the gadget switches from being parsed as SVG to being parsed as HTML. - The gadget is written in such a way that it exploits the parsing differences between HTML and MathML.
As far as we know, the gadget can only be written using a tag that is parsed as raw text in HTML. These [elements] are:
- title - textarea - xmp - iframe - noembed - noframes - plaintext - noscript - style - script
Applications that do not explicitly allow any of these tags should not be affected, since none are allowed by default.
[elements]: https://github.com/servo/html5ever/blob/a027c2835472d518893c906dc29c42200af3c960/html5ever/src/treebuilder/rules.rs
---
This vulnerability was reported by Roger Meyer.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rust/ammoniato a version that resolves this vulnerability.Fixed in 3.3.5 - Upgrade
Upgrade
rust/ammoniato a version that resolves this vulnerability.Fixed in 4.1.9 - Upgrade
Upgrade
rust/ammoniato a version that resolves this vulnerability.Fixed in 4.2.5
Event History
Frequently Asked Questions
Which Ammonia configurations are realistically exposed?
Exposure requires explicitly allowing at least one HTML raw-text element: title, textarea, xmp, iframe, noembed, noframes, plaintext, noscript, style, or script. These elements are not allowed by default, so configurations that do not explicitly permit any of them should not be affected.
What must an attacker be able to control to exploit this?
The attacker must be able to supply markup that is parsed differently as HTML and as foreign XML, and must be able to use an allowed raw-text HTML element as part of a parsing-difference gadget. The affected filtering scenario also involves allowed MathML text integration points or SVG foreignObject combined with cross-namespace content.
How can I assess whether my application is affected?
Review your Ammonia allowlist for title, textarea, xmp, iframe, noembed, noframes, plaintext, noscript, style, or script, including any custom policy that enables them. If none are explicitly allowed, the advisory states the application should not be affected.