The vulnerability arises because the Ammonia library does not properly sanitise the SVG <animate> and <set> elements. When an SVG animation with an attributeName of 'href' contains a value that uses the 'javascript:' scheme, the sanitizer leaves the script‑bearing link intact. An attacker can inject such an SVG into untrusted HTML, have it stored in the application, and when a user later clicks on the link, the attacker’s JavaScript is executed in the context of the application’s origin. This constitutes a stored cross‑site scripting flaw, allowing an attacker to steal cookies, modify page content, or perform actions on behalf of users.

Affected products are the Rust‑Ammonia sanitisation library under the vendor identifier rust‑ammonia:ammonia. Versions older than 3.3.3, 4.0.3, and 4.1.4 are vulnerable. Any application that allows users to upload or embed SVG content that includes <animate> or <set> elements, and then stores that content for later rendering, is at risk. The fix is released in the specified version lines and can be obtained from the official releases list.

The CVSS score of 5.4 indicates a medium impact, but the vulnerability can lead to full compromise of the application’s front‑end if an attacker successfully lures a user to click the malicious link. EPSS data is not provided, so the likelihood of exploitation cannot be quantified, and the vulnerability is not yet in the CISA KEV catalog. Attackers would need to supply crafted SVG content that is later rendered; having a stored payload means the compromise can spread to any user who views the data. Because the flaw is triggered by user interaction (clicking the link), the risk is tied to user behavior, but the potential damage remains substantial.