generated has two known RUSTSEC advisories (not currently exploitable here) #64

New issue

Closed

opened 2026-10-29 14:19:04 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-29 14:19:04 +00:00

Owner

Originally created by @Svector-anu on GitHub (Aug 22, 2026).
Original GitHub issue: https://github.com/kvcache-ai/AgentENV/issues/208

What I found

src/api/generated/Cargo.toml pins ammonia = "4", which resolves to 4.1.2 in Cargo.lock. That version is affected by two published advisories:

RUSTSEC-2026-0193 — mXSS in ammonia via MathML annotation-xml encoding strip (fixed in 4.1.3)
RUSTSEC-2026-0213 — XSS in ammonia via SVG animate/set animation tags (fixed in 4.1.4)

Why I'm not calling this exploitable

I checked how ammonia is actually used before filing — the only calls in the codebase are ammonia::is_html(...) in src/api/generated/src/models.rs, used purely as a boolean detector for input validation. Both advisories describe flaws in ammonia's HTML sanitization/cleaning output (clean()), which this codebase never calls. So the vulnerable code path isn't reachable through current usage.

Suggested fix

Bumping to ammonia >= 4.1.4 (still within the "4" requirement) is a no-risk, semver-compatible fix — closes both advisories regardless of current reachability, and removes the question if is_html's usage ever expands to sanitization later. Since src/api/generated/ is documented as machine-managed in CLAUDE.md, I didn't open a PR against generated output directly — flagging here so it can go through your normal codegen/regen path (make agentenv-server) instead.

Ran the full sanctioned scan (semgrep, trufflehog, osv-scanner) plus a manual review of the auth middleware, API key comparison, and secure-sandbox design — everything else came back clean. Happy to share more detail if useful.

Originally created by @Svector-anu on GitHub (Aug 22, 2026). Original GitHub issue: https://github.com/kvcache-ai/AgentENV/issues/208 ## What I found `src/api/generated/Cargo.toml` pins `ammonia = "4"`, which resolves to `4.1.2` in `Cargo.lock`. That version is affected by two published advisories: - [RUSTSEC-2026-0193](https://rustsec.org/advisories/RUSTSEC-2026-0193.html) — mXSS in ammonia via MathML `annotation-xml` encoding strip (fixed in 4.1.3) - [RUSTSEC-2026-0213](https://rustsec.org/advisories/RUSTSEC-2026-0213.html) — XSS in ammonia via SVG `animate`/`set` animation tags (fixed in 4.1.4) ## Why I'm not calling this exploitable I checked how `ammonia` is actually used before filing — the only calls in the codebase are `ammonia::is_html(...)` in `src/api/generated/src/models.rs`, used purely as a boolean detector for input validation. Both advisories describe flaws in ammonia's HTML **sanitization/cleaning** output (`clean()`), which this codebase never calls. So the vulnerable code path isn't reachable through current usage. ## Suggested fix Bumping to `ammonia >= 4.1.4` (still within the `"4"` requirement) is a no-risk, semver-compatible fix — closes both advisories regardless of current reachability, and removes the question if `is_html`'s usage ever expands to sanitization later. Since `src/api/generated/` is documented as machine-managed in `CLAUDE.md`, I didn't open a PR against generated output directly — flagging here so it can go through your normal codegen/regen path (`make agentenv-server`) instead. Ran the full sanctioned scan (semgrep, trufflehog, osv-scanner) plus a manual review of the auth middleware, API key comparison, and secure-sandbox design — everything else came back clean. Happy to share more detail if useful.

bsakaguchi closed this issue

2026-10-29 14:19:04 +00:00

bsakaguchi referenced this issue

2026-10-29 14:20:16 +00:00

[PR #64] [MERGED] fix(sandbox): resume sandbox upon recoverable pause failure #149