Prior to releases 3.3.2, 4.0.2 and 4.1.3, the Rust library ammonia fails to enforce the encoding‑dependent namespace rules of annotation‑xml after attribute filtering removes the encoding attribute. As a result, a sanitized document that contains the math, annotation‑xml and at least one raw‑text element can be parsed by the browser under a different namespace, allowing an attacker to inject executable JavaScript. This flaw is a classic DOM‑based cross‑site scripting vulnerability (CWE‑79) that can compromise user session data, deface content or run arbitrary code within the context of the browser that displays the sanitized HTML.

Applications that use rust‑ammonia and explicitly enable the math, annotation‑xml and raw‑text tags while disabling the encoding attribute are vulnerable. Versions of ammonia released before 3.3.2, 4.0.2 and 4.1.3 contain the flaw; the issue has been fixed in these subsequent releases.

The vulnerability carries a CVSS score of 6.3, indicating medium severity. EPSS data is currently not available, and the flaw is not listed in the CISA KEV catalog. The exploitation conditions are non‑default: an attacker must control the content, enable the problematic tags, and remove the encoding attribute. When these conditions are met, the attacker can trigger JavaScript execution in the victim’s browser during rendering of the sanitized output.