CVE-2026-63430

Summary

ammonia: mXSS via MathML `annotation-xml` encoding strip

Severity

medium

EPSS

0.6% (p46)

CWE

CWE-79

Also known as

GHSA-9jh8-v38h-cvhr

Published

2026-10-22

Updated

2026-10-22

Advisory details

If a certain set of MathML tags are enabled, an attacker can inject arbitrary JavaScript code into the user's browser.

The annotation-xml tag has slightly different behavior than the other "integration point" tags in MathML and SVG, but ammonia didn't handle it, so it didn't correctly strip the namespace-incompatible tags.

This vulnerability only has an effect when the math and annotation-xml tags are both enabled, but the encoding attribute is disabled, because it relies on the following sequence of steps:

1. User writes code like <math><annotation-xml encoding="text/html"><gadget></annotation-xml></math>.
2. Namespace filtering checks the DOM, and it passes. <gadget> is parsed as HTML.
3. Attribute filter strips it down to <math><annotation-xml><gadget></annotation-xml></math>. Because the encoding attribute is gone, <gadget> is now parsed as MathML.
4. The gadget is written in such a way that it exploits the parsing differences between HTML and MathML.

Additionally, the gadget can only be written using a tag that is parsed as raw text in HTML. These elements are:

• title
• textarea
• xmp
• iframe
• noembed
• noframes
• plaintext
• noscript
• style
• script

Applications that do not explicitly allow any of these tags should not be affected, since none are allowed by default.

Impact

Low: Requires both MathML and at least one raw-text HTML tag to be enabled, and most websites don't enable either of those.

Patches

• https://github.com/rust-ammonia/ammonia/pull/245 (released in 4.1.3)
• https://github.com/rust-ammonia/ammonia/pull/244 (released in 4.0.2)
• https://github.com/rust-ammonia/ammonia/pull/243 (released in 3.3.2)

Workarounds

Call builder.add_clean_content_tags("annotation-xml") to remove the annotation-xml element and all of its children, including the XSS gadget.

References

• https://github.com/advisories/GHSA-9jh8-v38h-cvhr
• https://github.com/rust-ammonia/ammonia/security/advisories/GHSA-9jh8-v38h-cvhr
• https://nvd.nist.gov/vuln/detail/CVE-2026-63430
• https://github.com/rust-ammonia/ammonia/pull/243
• https://github.com/rust-ammonia/ammonia/pull/244
• https://github.com/rust-ammonia/ammonia/pull/245
• https://github.com/rust-ammonia/ammonia/commit/004bf2cee4288f74a6ee619d589e3e90c24c09ca
• https://github.com/rust-ammonia/ammonia/commit/7ac3fd3145236f28857eeecbadb544c8659cba31

Related advisories

• CVE-2026-102342 — medium · crates.io/ammonia
• GHSA-cg2g-xh64-v4q7 — critical · npm/dompurify
• CVE-2026-102989 — critical · npm/@tanstack/start-server-core
• CVE-2026-104252 — critical · Go/vitess.io/vitess
• CVE-2026-107845 — critical · Packagist/contao/comments-bundle
• CVE-2026-106102 — critical · npm/quasar
• CVE-2026-10032 — critical · npm/@a2ui/web_core
• CVE-2026-59167 — critical · npm/suneditor

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity