ammonia has 5 CVEs on record between 2021 and 2026. 2 were published in the last 90 days. The median CVSS is 5.4 (medium). None have a confirmed exploitation report.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 5.4
- Publish → KEV
- —
- Last 90 days
- 2 prev 1
Weakness classes
Products
- ammonia 5
Worst active — by depth score
CVE-2026-102342Medium· 5.4ammonia is a Rust library for repairing and securing untrusted HTML30RUSTSEC-2026-0373NoneMissing case-insensitive matching for CSS url function3RUSTSEC-2026-0213NoneXSS in ammonia via SVG `animate` and `set` animation tags3RUSTSEC-2021-0158NoneXSS in ammonia via SVG `animateMotion`, `animateTransform`, and/or `animateColor` tags3RUSTSEC-2021-0157NoneIncorrect escaping for `url("")` functions in CSS style attributes3
ammonia vulnerabilities
CVEs affecting ammonia, newest first. Open any entry for full detail, references, and exploit status.
5 CVEsRSS
RUSTSEC-2026-0373NoneMissing case-insensitive matching for CSS url function
Missing case-insensitive matching for CSS url function
CVE-2026-102342Medium· 5.4ammonia is a Rust library for repairing and securing untrusted HTML
ammonia is a Rust library for repairing and securing untrusted HTML. Prior to 3.3.3, 4.0.3, and 4.1.4, applications that allow the SVG animate or set elements can retain an animation whose attributeName targets href and whose value uses …
RUSTSEC-2026-0213NoneXSS in ammonia via SVG `animate` and `set` animation tags
XSS in ammonia via SVG `animate` and `set` animation tags
RUSTSEC-2021-0158NoneXSS in ammonia via SVG `animateMotion`, `animateTransform`, and/or `animateColor` tags
XSS in ammonia via SVG `animateMotion`, `animateTransform`, and/or `animateColor` tags
RUSTSEC-2021-0157NoneIncorrect escaping for `url("")` functions in CSS style attributes
Incorrect escaping for `url("")` functions in CSS style attributes