{"id":"RUSTSEC-2021-0157","aliases":["GHSA-69v2-w9vg-4g83"],"title":"Incorrect escaping for `url(\"\")` functions in CSS style attributes","summary":"Incorrect escaping for `url(\"\")` functions in CSS style attributes","severity":"none","vendor":"ammonia","product":"ammonia","ecosystem":"rust","affected":["ammonia >= 4.2.0, < 4.2.3"],"patched":["ammonia 4.2.3"],"published":"2021-10-10","updated":"2026-10-12","sourceUpdated":"2026-10-12T18:15:01.959978734Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2021-0157","references":[{"url":"https://crates.io/crates/ammonia"},{"url":"https://rustsec.org/advisories/RUSTSEC-2021-0157.html"},{"url":"https://github.com/rust-ammonia/ammonia/pull/259"}],"tags":["osv","rust"],"ingestedAt":"2026-10-13T11:45:30.153Z","slug":"RUSTSEC-2021-0157","body":"## Overview\n\nIn some cases, quotation marks in CSS url() functions are not escaped. This allows CSS injection. This feature is not enabled by default, so an application is vulnerable if, and only if, the style attribute is allowed and filter_style_properties is used.\n\nAs an example, this snippet:\n\n```html\n<div style='background:url(\"cid:\\\");EVIL_CSS_HERE;background:url(\\\"cid:\")'>\n```\n\nWould erroneously \"sanitize\" to:\n\n```html\n<div style='background:url(\"cid:\");EVIL_CSS_HERE;background:url(\"cid:\")'>\n```\n\n---\n\nThis vulnerability was reported by Uttej Badwane\n\n## Affected packages\n\n- `ammonia >= 4.2.0, < 4.2.3`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `ammonia 4.2.3`","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}