RustSeverity: MediumStatus: Published

Missing handling for SVG animateTransform, animateMotion, and animateColor

The neutralization ammonia applied to the SVG animate and set elements was not applied to animateTransform, animateMotion and animateColor, so these could set an href to a javascript: URL and lead to stored XSS in applications that allow those tags. Fixed in 4.1.7 and 4.2.3. Reported by email to the maintainer.