PatchSiren

rust-ammonia CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM rust-ammonia CVE published 2026-10-15

CVE-2026-63430

A mutation cross-site scripting (mXSS) vulnerability exists in the ammonia Rust library, which can allow an attacker to execute JavaScript when a user renders sanitized output. The issue arises from incorrect implementation of MathML integration-point behavior after attribute filtering removes encoding. This vulnerability affects applications that explicitly allow the math tag, annotation-xml, and at leas [truncated]