RUSTSEC-2021-0157

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2021-0157

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2021-0157.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2021-0157

Aliases

GHSA-69v2-w9vg-4g83

Published

2021-10-10T12:00:00Z

Modified

2026-10-12T18:15:01Z

Summary

Incorrect escaping for `url("")` functions in CSS style attributes

Details

In some cases, quotation marks in CSS url() functions are not escaped. This allows CSS injection. This feature is not enabled by default, so an application is vulnerable if, and only if, the style attribute is allowed and filter_style_properties is used.

As an example, this snippet:

<div style='background:url("cid:\");EVIL_CSS_HERE;background:url(\"cid:")'>

Would erroneously "sanitize" to:

<div style='background:url("cid:");EVIL_CSS_HERE;background:url("cid:")'>

This vulnerability was reported by Uttej Badwane

Database specific

{
    "license":  "CC0-1.0"
}

References

Affected packages

crates.io / ammonia

Package

Name: ammonia; View open source insights on deps.dev
Purl: pkg:cargo/ammonia

Affected ranges

Type: SEMVER
Events: Introduced

0.0.0-0

Fixed

4.1.7

Introduced

4.2.0

Fixed

4.2.3

Ecosystem specific

{
    "affected_functions":  null,
    "affects":  {
        "arch":  [],
        "functions":  [],
        "os":  []
    }
}