CVE-2026-63430

A flaw was found in ammonia. This vulnerability allows a remote attacker to conduct cross-site scripting (XSS) by submitting specially crafted markup to an application configured to permit specific Mathematical Markup Language (MathML) tags and raw-text elements. Because ammonia does not correctly handle namespace parsing changes after removing tag attributes, the sanitized output is reinterpreted differently by the web browser. Consequently, an attacker can execute arbitrary JavaScript in the context of a user's browser session when the output is rendered.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.