# RUSTSEC-2026-0345: Untrusted labels can inject SVG attributes, CSS values, and terminal escape sequences > Attackers can inject malicious scripts or terminal escape sequences via untrusted labels in SVG or terminal outputs, requiring user interaction to execute. - **Severity:** Not scored - **Exploited in the wild:** Not known - **Login needed:** Not needed - **Attackable:** Over the internet - **Victim action needed:** A user has to click or open something - **Fix available:** Yes - **Published:** 7 Aug 2026 - **Also known as:** GHSA-3c48-9r95-hqhr ## What is RUSTSEC-2026-0345? RUSTSEC-2026-0345 is a cross-site scripting vulnerability in kuva, published on 7 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link. ### Official description Affected versions of `kuva` wrote data-derived strings straight into rendered output without escaping them for the target format. Applications that plot untrusted input (column headers, category and group names, series labels) were affected in three places. **1. SVG attribute injection / stored XSS (CWE-79).** When SVG interactivity was enabled via `Layout::with_interactive`, group and category labels were formatted directly into `data-group` and `data-x` attributes through the raw `Primitive::GroupStart.extra_attrs` string, which the SVG backend emitted verbatim. The backend's escaping helper covered text nodes and `` but not attributes. A label containing a double quote could close the attribute and add another, for example an event handler. Opening the resulting SVG in a browser, or inlining it into an HTML page, executed the injected script. Reachable from scatter, line, bar, and strip plots, and from legends. **2. Unvalidated CSS and style attribute values (CWE-74).** `Color::Css` wrote arbitrary strings into `fill` and `stroke`, `stroke-dasharray` was emitted raw from the public dash-pattern builders, and the SVG root `font-family` and `fill` plus the background rectangle `fill` were written raw from layout and theme configuration. Applications that forwarded user-supplied style values into the plotting API could have those values break out of the attribute they were written into. **3. Terminal escape sequence injection (CWE-150).** `TerminalBackend` stored label characters unfiltered and emitted each one unconditionally when producing its ANSI string. Control characters in a label, including ESC, OSC sequences, and carriage returns, were written straight to the operator's terminal. Depending on the emulator this allows forged or misleading output, window title and clipboard manipulation, and reaching terminal emulator vulnerabilities that are triggered by escape sequences. The fix routes every data-derived string through format-appropriate escaping. A single `escape_attr` helper XML-escapes `&`, `<`, `>`, `"`, and `'`, and is applied at each raw-attribute site: the `extra_attrs` interpolations, the `Color::Css` catch-all, and the SVG backend's `stroke-dasharray`, `font-family`, and background `fill` writes. `TerminalBackend::set_char` replaces control characters with U+FFFD before they enter the character grid, so one cell stays one column rather than the grid shifting, and the ANSI writer emits the grid unchanged. Patched in 0.5.0, with backports to 0.4.1 for the 0.4.x line and 0.3.1 for users still on 0.1.5 through 0.3.0. No versions were yanked. Users who cannot upgrade should sanitize labels before passing them to `kuva`, and avoid interactive SVG output for untrusted data. Note that `Scene::defs`, `Scene::scripts`, and `Primitive::GroupStart.extra_attrs` remain raw escape hatches by design. They are documented as trusted-only and are not covered by this advisory; populating them from user data is equivalent to executing that data. ## Which versions are affected by RUSTSEC-2026-0345? 1 open source package ship an affected version, including kuva. | Package | Ecosystem | Affected | Fixed in | | --- | --- | --- | --- | | `kuva` | crates.io | From 0.1.5 | 0.3.1, 0.4.1 | ## How do I fix RUSTSEC-2026-0345? Upgrade kuva to a fixed version for your release line: 0.3.1 or 0.4.1. ## Is RUSTSEC-2026-0345 being exploited? There is no known exploitation of RUSTSEC-2026-0345 in the wild and no public exploit code. ## Fix prompt for AI coding agents ```text Check this codebase for RUSTSEC-2026-0345 and fix it if it is affected. What it is: RUSTSEC-2026-0345 is a cross-site scripting vulnerability in kuva, published on 7 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link. Exploitation: There is no known exploitation of RUSTSEC-2026-0345 in the wild and no public exploit code. Affected packages and fixed versions: - kuva (crates.io): affected from 0.1.5; fixed in 0.3.1, 0.4.1 Task: 1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies. 2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it. 3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead. 4. Run the tests and summarise what changed and why. 5. If nothing in the project is affected, say so and change nothing. Reference: https://insights.sbomify.com/RUSTSEC-2026-0345/ (Markdown: https://insights.sbomify.com/RUSTSEC-2026-0345/index.md) ``` ## Sources - OSV: https://osv.dev/vulnerability/RUSTSEC-2026-0345 --- From sbomify Insights: https://insights.sbomify.com/RUSTSEC-2026-0345/ Summaries are generated and may contain mistakes; the official description above is the record.