{"action":"Upgrade ammonia to 3.3.1 or later.","affected":[{"fixed":"4.1.2","introduced":"4.1.0"},{"fixed":"4.0.1","introduced":"4.0.0"},{"fixed":"3.3.1","introduced":"0"}],"component":"ammonia","cve_ids":[],"ecosystem":"crates.io","exploited":false,"fixed_versions":["4.1.2","4.0.1","3.3.1"],"ghsa_id":"GHSA-mm7x-qfjj-5g2c","id":"tcs_01M5KF1S67QPSKRNTXMJZ1EJ7C","modified_at":"2026-09-10T03:50:28.411338408Z","published_at":"2025-09-22T15:40:15Z","references":["https://osv.dev/vulnerability/GHSA-mm7x-qfjj-5g2c","https://github.com/rust-ammonia/ammonia/commit/de0297111a3a1273275b670960bcd47a0481718e","https://github.com/rust-ammonia/ammonia","https://rustsec.org/advisories/RUSTSEC-2025-0071.html"],"severity":{"label":"low"},"sources":[{"source":"osv","source_id":"GHSA-mm7x-qfjj-5g2c","url":"https://osv.dev/vulnerability/GHSA-mm7x-qfjj-5g2c"}],"summary":"Ammonia incorrectly handles embedded SVG and MathML leading to mutation XSS after removal"}