CVE-2026-102342

A flaw was found in ammonia. This flaw allows stored Cross-Site Scripting (XSS) in applications configured to permit SVG animate or set elements. The sanitizer fails to properly neutralize animation attributes that target link destinations with JavaScript URIs. A remote attacker can exploit this vulnerability by supplying crafted SVG content, creating clickable links that execute arbitrary script in the user's browser session.

A MODERATE severity stored cross-site scripting (XSS) flaw was found in ammonia, a Rust HTML sanitization library that is shipped in Red Hat Enterprise Linux (via the rust and rust-toolset components) and bundled in other Red Hat products such as Red Hat Ansible Automation Platform, Red Hat Satellite, and Red Hat In-Vehicle OS through the ammonia crate or its nh3 Python bindings. When an application using ammonia is configured to permit the SVG animate or set elements, the sanitizer fails to neutralize animations that set a link's href attribute to a javascript: URI. A remote attacker who can store crafted SVG content in such an application can create a clickable link that executes attacker-controlled script in the application's origin when a victim clicks it, allowing actions to be performed on behalf of the victim and access to their session data. The Red Hat CVSS 3.1 score of 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) matches the upstream severity. Ansible Automation Platform components whose bundled ammonia version is outside the affected range are not affected because the vulnerable code is not present. For in-support Red Hat products the fix is currently deferred: the flaw is rated MODERATE with a CVSS score below 7.0, which does not meet Red Hat's threshold for filing fix trackers at this severity, and the residual risk is limited to applications that explicitly allow the SVG animate or set tags, with exploitation further requiring a victim to click the crafted link. The affected Fedora and EPEL python-nh3 packages are delegated to the community, where a fix is being pursued; streams that are out of support scope will not receive a fix through Red Hat update channels.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

A workaround exists for applications that use ammonia: remove the SVG animate and set elements from the sanitizer's allowed-tags configuration. Applications that do not permit these tags are not affected by this flaw. Otherwise, upgrade to an upstream release containing the fix (ammonia 3.3.3, 4.0.3, or 4.1.4, depending on the major version in use); for Red Hat products, apply updates when they become available through the appropriate support channels.