Deps.rs

mdbook 0.4.44

[![dependency status](https://deps.rs/crate/mdbook/0.4.44/status.svg)](https://deps.rs/crate/mdbook/0.4.44)

This project might be open to known security vulnerabilities, which can be prevented by tightening the version range of affected dependencies. Find detailed information at the bottom.

Crate mdbook

Dependencies

(28 total, 7 outdated, 1 possibly insecure)

CrateRequiredLatestStatus
 ammonia ⚠️^4.0.04.1.4maybe insecure
 anyhow^1.0.711.0.104up to date
 chrono^0.4.240.4.45up to date
 clap^4.3.124.6.5up to date
 clap_complete^4.3.24.6.8up to date
 elasticlunr-rs^3.0.23.1.0up to date
 env_logger^0.11.10.11.11up to date
 futures-util^0.3.280.3.33up to date
 handlebars^6.06.4.3up to date
 ignore^0.4.200.4.33up to date
 log^0.4.170.4.33up to date
 memchr^2.5.02.8.3up to date
 notify^8.0.08.2.0up to date
 notify-debouncer-mini^0.6.00.7.0out of date
 once_cell^1.17.11.21.4up to date
 opener^0.7.00.8.5out of date
 pathdiff^0.2.10.2.3up to date
 pulldown-cmark^0.10.00.13.4out of date
 regex^1.8.11.13.1up to date
 serde^1.0.1631.0.229up to date
 serde_json^1.0.961.0.151up to date
 shlex^1.3.02.0.1out of date
 tempfile^3.4.03.27.0up to date
 tokio^1.28.11.53.1up to date
 toml^0.5.111.1.4+spec-1.1.0out of date
 topological-sort^0.2.20.3.0out of date
 walkdir^2.3.32.5.0up to date
 warp^0.3.60.4.3out of date

Dev dependencies

(6 total, all up-to-date)

CrateRequiredLatestStatus
 assert_cmd^2.0.112.2.2up to date
 predicates^3.0.33.1.4up to date
 pretty_assertions^1.3.01.4.1up to date
 select^0.6.00.6.1up to date
 semver^1.0.171.0.28up to date
 walkdir^2.3.32.5.0up to date

Security Vulnerabilities

ammonia: XSS in ammonia via SVG `animate` and `set` animation tags

RUSTSEC-2026-0213

The following SVG will produce a link with a javascript scheme. If the user clicks this link, they will run it.

<svg xmlns="http://www.w3.org/2000/svg">
  <a>
    <set attributeName="href" to="javascript:alert('SET_XSS')"></set>
    <text y="30">Click set</text>
  </a>
</svg>

Ammonia did not apply attribute filters based on attributeName, so the contents of the to, from, and values tags were not sanitized as URLs.

Applications that do not explicitly allow either of these tags should not be affected, since neither are allowed by default.

Discovered by: Younghun Ko (@koyokr)