CVE-2026-63430 ammonia: mXSS in ammonia via MathML `annotation-xml` encoding strip

ammonia is a Rust library for repairing and securing untrusted HTML. Prior to 3.3.2, 4.0.2, and 4.1.3, applications that explicitly allow the math tag, annotation-xml, and at least one raw-text HTML element while disallowing the encoding attribute can permit mutation cross-site scripting. ammonia...

CVE-2026-63430

The ammonia Rust library, used for securing untrusted HTML, is vulnerable to mutation cross-site scripting (mXSS) prior to versions 3.3.2, 4.0.2, and 4.1.3 . The root cause is the incorrect handling of the annotation-xml tag during attribute filtering. When the math and annotation-xml tags are en...