---
id: "CVE-2026-63430"
kind: "vulnerability"
aliases: ["CVE-2026-63430", "GHSA-9jh8-v38h-cvhr"]
title: "ammonia: mXSS  via MathML `annotation-xml` encoding strip"
severity: "medium"
cvss: 6.3
epss: 0.005539999809116125
exploited: false
status: "open"
category: "package"
products: [{"name": "ammonia", "fixed": ["3.3.2"], "affected": "< 3.3.2", "ecosystem": "cargo"}, {"name": "ammonia", "fixed": ["4.0.2"], "affected": ">= 4.0.0, < 4.0.2", "ecosystem": "cargo"}, {"name": "ammonia", "fixed": ["4.1.3"], "affected": ">= 4.1.0, < 4.1.3", "ecosystem": "cargo"}]
ecosystems: ["cargo"]
tags: ["ammonia", "cwe-79", "html-sanitization", "package", "rust", "web-apps"]
not_affected_if: ["annotation-xml-not-allowed", "default-config", "encoding-attribute-allowed", "math-not-allowed"]
published_at: "2026-10-15T19:17:42+00:00"
first_seen_at: "2026-10-23T19:11:32+00:00"
updated_at: "2026-10-23T23:44:52+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-9jh8-v38h-cvhr", "first_seen_at": "2026-10-23T19:11:32+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63430", "first_seen_at": "2026-10-23T23:44:52+00:00"}]
---

# ammonia: mXSS  via MathML `annotation-xml` encoding strip

ammonia is a Rust HTML sanitizer, and this flaw lets crafted MathML markup slip past its filter when the math and annotation-xml tags are both allowed and the encoding attribute is not. A remote attacker who gets such input through the sanitizer can run arbitrary JavaScript in the victim's browser.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- cargo:ammonia affected < 3.3.2 fixed 3.3.2
- cargo:ammonia affected >= 4.0.0, < 4.0.2 fixed 4.0.2
- cargo:ammonia affected >= 4.1.0, < 4.1.3 fixed 4.1.3

## How to check

Check Cargo.lock for ammonia versions below 3.3.2, 4.0.2 (for 4.0.x), or 4.1.3 (for 4.1.x).
Check builder code for allowed tags: look for add_tags or tags containing "math" and "annotation-xml" without the encoding attribute allowed.

## Fix

Upgrade ammonia to 3.3.2, 4.0.2, or 4.1.3 depending on your major line.
As a workaround, call builder.add_clean_content_tags("annotation-xml") to remove that element and its children.

## Timeline

- 2026-10-23T19:11:32+00:00 ghsa https://github.com/advisories/GHSA-9jh8-v38h-cvhr
- 2026-10-23T23:44:52+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-63430

## From the sources

If a certain set of MathML tags are enabled, an attacker can inject arbitrary JavaScript code into the user's browser.

The `annotation-xml` tag has slightly different behavior than the other "integration point"
tags in MathML and SVG, but ammonia didn't handle it, so it didn't correctly
strip the namespace-incompatible tags.

This vulnerability only has an effect when the `math` and `annotation-xml` tags
are both enabled, but the `encoding` attribute is disabled, because it relies
on the following sequence of steps:

1. User writes code like `<math><annotation-xml encoding="text/html"><gadget></annotation-xml></math>`.
2. Namespace filtering checks the DOM, and it passes. `<gadget>` is parsed as HTML.
3. Attribute filter strips it down to `<math><annotation-xml><gadget></annotation-xml></math>`. Because the encoding attribute is gone, `<gadget>` is now parsed as MathML.
4. The gadget is written in such a way that it exploits the parsing differences between HTML and MathML.

Additionally, the gadget can only be written using a tag that is parsed as raw text in HTML.
These [elements] are:

* title
* textarea
* xmp
* iframe
* noembed
* noframes
* plaintext
* noscript
* style
* script

Applications that do not explicitly allow any of these tags should not be affected, since none are allowed by default.

[elements]: https://github.com/servo/html5ever/blob/045a0378f2b0f8d4a350793899cf722a2a9b3d11/html5ever/src/tree_builder/rules.rs

### Impact

Low: Requires both MathML and at least one raw-text HTML tag to be enabled, and most websites don't enable either of those.

### Patches

- https://github.com/rust-ammonia/ammonia/pull/245 (released in 4.1.3)
- https://github.com/rust-ammonia/ammonia/pull/244 (released in 4.0.2)
- https://github.com/rust-ammonia/ammonia/pull/243 (released in 3.3.2)

### Workarounds

Call <code>builder.[add_clean_content_tags](https://docs.rs/ammonia/latest/ammonia/struct.Builder.html#method.add_clean_content_tags)("annotation-xml")</code> to remove the annotation-xml element and all of its children, including the XSS gadget.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_