RUSTSEC-2021-0157None▾ SunlitIncorrect escaping for `url("")` functions in CSS style attributes
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
In some cases, quotation marks in CSS url() functions are not escaped. This allows CSS injection. This feature is not enabled by default, so an application is vulnerable if, and only if, the style attribute is allowed and filter_style_properties is used.
As an example, this snippet:
<div style='background:url("cid:\");EVIL_CSS_HERE;background:url(\"cid:")'>
Would erroneously "sanitize" to:
<div style='background:url("cid:");EVIL_CSS_HERE;background:url("cid:")'>
This vulnerability was reported by Uttej Badwane
ammonia >= 4.2.0, < 4.2.3Upgrade to a patched release:
ammonia 4.2.3Connected by shared product, vendor, weakness, or advisory.
RUSTSEC-2021-0158NoneXSS in ammonia via SVG `animateMotion`, `animateTransform`, and/or `animateColor` tags
CVE-2026-102342Medium· 5.4ammonia is a Rust library for repairing and securing untrusted HTML
RUSTSEC-2026-0213NoneXSS in ammonia via SVG `animate` and `set` animation tags
CVE-2026-63430NonemXSS in ammonia via MathML `annotation-xml` encoding strip