Findings

RUSTSEC-2026-0345

Untrusted labels can inject SVG attributes, CSS values, and terminal escape sequences

Published Aug 7, 2026 · updated Oct 13, 2026

Affected versions of wrote data-derived strings straight into rendered output without escaping them for the target format. Applications that plot untrusted input (column headers, category and group names, series labels) were affected in three places. **1. SVG attribute injection / stored XSS (CWE-79).** When SVG interactivity was enabled via , group and category labels were formatted directly into and attributes through the raw string, which the SVG backend emitted verbatim. The backend's escaping helper covered text nodes and but not attributes. A label containing a double quote could close the attribute and add another, for example an event handler. Opening the resulting SVG in a browser, or inlining it into an HTML page, executed the injected script. Reachable from scatter, line, bar, and strip plots, and from legends. **2. Unvalidated CSS and style attribute values (CWE-74).** wrote arbitrary strings into and , was emitted raw from the public dash-pattern builders, and the SVG root and plus the background rectangle were written raw from layout and theme configuration. Applications that forwarded user-supplied style values into the plotting API could have those values break out of the attribute they were written into. **3. Terminal escape sequence injection (CWE-150).** stored label characters unfiltered and emitted each one unconditionally when producing its ANSI string. Control characters in a label, including ESC, OSC sequences, and carriage returns, were written straight to the operator's terminal. Depending on the emulator this allows forged or misleading output, window title and clipboard manipulation, and reaching terminal emulator vulnerabilities that are triggered by escape sequences. The fix routes every data-derived string through format-appropriate escaping. A single helper XML-escapes , , , , and , and is applied at each raw-attribute site: the interpolations, the catch-all, and the SVG backend's , , and background writes. replaces control characters