{"id":"CVE-2021-38193","aliases":["GHSA-5325-xw5m-phm3","RUSTSEC-2021-0074"],"url":"https://o3.security/vulnerability/CVE-2021-38193","summary":"Cross-site Scripting in ammonia","details":"An issue was discovered in the ammonia crate before 3.1.0 for Rust. XSS can occur because the parsing differences for HTML, SVG, and MathML are mishandled, a similar issue to CVE-2020-26870.","published":"2021-08-08T06:15:09.043Z","modified":"2026-07-09T01:31:38.768656Z","cvss":{"score":6.1,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":1,"affectedPackages":[{"ecosystem":"crates.io","name":"ammonia","fixedVersion":"3.1.0"},{"ecosystem":"crates.io","name":"ammonia","fixedVersion":"2.1.3"}],"fix":{"url":"https://github.com/rust-ammonia/ammonia/pull/142","label":"rust-ammonia/ammonia#142"},"references":[{"type":"ADVISORY","url":"https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/ammonia/RUSTSEC-2021-0074.md"},{"type":"FIX","url":"https://rustsec.org/advisories/RUSTSEC-2021-0074.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-38193"},{"type":"WEB","url":"https://github.com/rust-ammonia/ammonia/pull/142"},{"type":"PACKAGE","url":"https://github.com/rust-ammonia/ammonia"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-09T01:31:38.768656Z"}}