RUSTSEC-2026-0373

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2026-0373

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0373.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2026-0373

Aliases

GHSA-x43w-36pp-96g3

Published

2026-10-16T12:00:00Z

Modified

2026-10-17T15:30:02Z

Summary

Missing case-insensitive matching for CSS url function

Details

URL filtering, such as relative URLs and URL scheme limits, is not always applied when CSS sanitization is used.

When the inner URL is quoted, CSS url("") is matched case-sensitively, when it should be matched case-insensitively. As a result, while url("") gets the intended domain name filtering, URL("") does not.

The following example shows how an application needs to be configured to trigger this bug.

let mut builder = Builder::new();
// allow inline styles
builder.filter_style_properties(hashset!["background-image"]);
builder.add_generic_attributes(&["style"]);
// notice that "http" URLs aren't allowed
builder.url_schemes(["cid"].into());

// attacker-controlled, presumably
let cleaned = builder.clean(r#"<div style='background:URL("https://evil.com/ping");'>"#);

// this is the expected result
assert_eq!(String::from(&cleaned), r#"<div style="">ok</p>"#);

// this is the result that the vulnerable version actually gets
assert_eq!(String::from(&cleaned), r#"<div style="background-image:URL(&quot;https://evil.com/ping&quot;);">ok</p>"#);

This can be used to inject tracking pixels where the application intended to prevent them. It does not allow XSS, and its usefulness for data exfiltration is limited.

This vulnerability was reported by Louis Li.

Database specific

{
    "license":  "CC0-1.0"
}

References

Affected packages

crates.io / ammonia

Package

Name: ammonia; View open source insights on deps.dev
Purl: pkg:cargo/ammonia

Affected ranges

Type: SEMVER
Events: Introduced

0.0.0-0

Fixed

4.1.8

Introduced

4.2.0

Fixed

4.2.4

Ecosystem specific

{
    "affected_functions":  null,
    "affects":  {
        "arch":  [],
        "functions":  [],
        "os":  []
    }
}