Ammonia: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

NVD Description

The following SVG will produce a link with a `javascript` scheme. If the user clicks this link, they will run it. ```svg <svg xmlns="http://www.w3.org/2000/svg"> <a> <set attributeName="href" to="javascript:alert('SET_XSS')"></set> <text y="30">Click set</text> </a> </svg> ``` ### Impact Allows stored XSS in applications that allow the `animate` and `set` tags. ### Patches Fixed in 3.3.3, 4.0.3, and 4.1.4 ### Workarounds Do not enable the `animate` or `set` tags.

Affected Packages (1)