Deps.rs

feed-rs 2.4.0

This project might be open to known security vulnerabilities, which can be prevented by tightening the version range of affected dependencies. Find detailed information at the bottom.

Crate feed-rs

Dependencies

(10 total, 2 outdated, 1 possibly insecure)

CrateRequiredLatestStatus
 ammonia ⚠️^4.1.34.1.4maybe insecure
 chrono^0.4.450.4.45up to date
 mediatype^0.21.00.23.0out of date
 quick-xml^0.41.00.42.0out of date
 regex^1.12.41.13.1up to date
 serde^1.0.2281.0.229up to date
 serde_json^1.0.1501.0.151up to date
 siphasher^1.0.31.0.3up to date
 url^2.5.82.5.8up to date
 uuid^1.23.41.25.0up to date

Security Vulnerabilities

ammonia: XSS in ammonia via SVG `animate` and `set` animation tags

RUSTSEC-2026-0213

The following SVG will produce a link with a javascript scheme. If the user clicks this link, they will run it.

<svg xmlns="http://www.w3.org/2000/svg">
  <a>
    <set attributeName="href" to="javascript:alert('SET_XSS')"></set>
    <text y="30">Click set</text>
  </a>
</svg>

Ammonia did not apply attribute filters based on attributeName, so the contents of the to, from, and values tags were not sanitized as URLs.

Applications that do not explicitly allow either of these tags should not be affected, since neither are allowed by default.

Discovered by: Younghun Ko (@koyokr)