{"id":"RUSTSEC-2021-0157","summary":"Incorrect escaping for `url(\"\")` functions in CSS style attributes","details":"In some cases, quotation marks in CSS url() functions are not escaped. This allows CSS injection. This feature is not enabled by default, so an application is vulnerable if, and only if, the style attribute is allowed and filter_style_properties is used.\n\nAs an example, this snippet:\n\n```html\n\u003cdiv style='background:url(\"cid:\\\");EVIL_CSS_HERE;background:url(\\\"cid:\")'\u003e\n```\n\nWould erroneously \"sanitize\" to:\n\n```html\n\u003cdiv style='background:url(\"cid:\");EVIL_CSS_HERE;background:url(\"cid:\")'\u003e\n```\n\n---\n\nThis vulnerability was reported by Uttej Badwane","aliases":["GHSA-69v2-w9vg-4g83"],"modified":"2026-10-12T18:15:01.959978734Z","published":"2021-10-10T12:00:00Z","database_specific":{"license":"CC0-1.0"},"references":[{"type":"PACKAGE","url":"https://crates.io/crates/ammonia"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2021-0157.html"},{"type":"WEB","url":"https://github.com/rust-ammonia/ammonia/pull/259"}],"affected":[{"package":{"name":"ammonia","ecosystem":"crates.io","purl":"pkg:cargo/ammonia"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"4.1.7"},{"introduced":"4.2.0"},{"fixed":"4.2.3"}]}],"ecosystem_specific":{"affected_functions":null,"affects":{"arch":[],"os":[],"functions":[]}},"database_specific":{"cvss":null,"informational":null,"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2021-0157.json","categories":["format-injection"]}}],"schema_version":"1.9.0"}