Untrusted labels can inject SVG attributes, CSS values, and terminal escape sequences

Affected versions of kuva wrote data-derived strings straight into rendered output without escaping them for the target format. Applications that plot untrusted input column headers, category and group names, series labels were affected in three places. 1. SVG attribute injection / stored XSS...

fynsul (0.2.0), lambert_w (>=2.0.1, <=2.0.3) potentially affected by unknown CVE via kuva (0.1.6)

kuva CARGO version 0.1.6 is affected by a known vulnerability. The following packages have a transitive dependency on kuva and may be impacted: - fynsul 0.2.0 - lambertw =2.0.1, =2.0.3 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0345...

RUSTSEC-2026-0345 Untrusted labels can inject SVG attributes, CSS values, and terminal escape sequences

Affected versions of kuva wrote data-derived strings straight into rendered output without escaping them for the target format. Applications that plot untrusted input column headers, category and group names, series labels were affected in three places. 1. SVG attribute injection / stored XSS...