CVE-2026-102342

Name of the Vulnerable Software and Affected Versions Ammonia versions prior to 3.3.3 Ammonia versions prior to 4.0.3 Ammonia versions prior to 4.1.4

Description Ammonia fails to apply attribute filters based on the attributeName variable, which allows the contents of the to, from, and values tags to bypass URL sanitization. This can lead to stored Cross-Site Scripting (XSS), where an attacker can inject a javascript scheme into an SVG link. If a user clicks the link, the malicious script will execute. This issue specifically affects applications that explicitly enable the animate and set tags.

Recommendations Update to version 3.3.3. Update to version 4.0.3. Update to version 4.1.4. Do not enable the animate or set tags.