---
id: RUSTSEC-2021-0157
aliases:
  - GHSA-69v2-w9vg-4g83
title: Incorrect escaping for `url("")` functions in CSS style attributes
summary: Incorrect escaping for `url("")` functions in CSS style attributes
severity: none
vendor: ammonia
product: ammonia
ecosystem: rust
affected:
  - 'ammonia >= 4.2.0, < 4.2.3'
patched:
  - ammonia 4.2.3
published: '2021-10-10'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T18:15:01.959978734Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/RUSTSEC-2021-0157'
references:
  - url: 'https://crates.io/crates/ammonia'
  - url: 'https://rustsec.org/advisories/RUSTSEC-2021-0157.html'
  - url: 'https://github.com/rust-ammonia/ammonia/pull/259'
tags:
  - osv
  - rust
ingestedAt: '2026-10-13T11:45:30.153Z'
---

## Overview

In some cases, quotation marks in CSS url() functions are not escaped. This allows CSS injection. This feature is not enabled by default, so an application is vulnerable if, and only if, the style attribute is allowed and filter_style_properties is used.

As an example, this snippet:

```html
<div style='background:url("cid:\");EVIL_CSS_HERE;background:url(\"cid:")'>
```

Would erroneously "sanitize" to:

```html
<div style='background:url("cid:");EVIL_CSS_HERE;background:url("cid:")'>
```

---

This vulnerability was reported by Uttej Badwane

## Affected packages

- `ammonia >= 4.2.0, < 4.2.3`

## Remediation

Upgrade to a patched release:

- `ammonia 4.2.3`