---
id: RUSTSEC-2026-0373
aliases:
  - GHSA-x43w-36pp-96g3
title: Missing case-insensitive matching for CSS url function
summary: Missing case-insensitive matching for CSS url function
severity: none
vendor: ammonia
product: ammonia
ecosystem: rust
affected:
  - 'ammonia >= 4.2.0, < 4.2.4'
patched:
  - ammonia 4.2.4
published: '2026-10-16'
updated: '2026-10-17'
sourceUpdated: '2026-10-17T15:30:02.378211969Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/RUSTSEC-2026-0373'
references:
  - url: 'https://crates.io/crates/ammonia'
  - url: 'https://rustsec.org/advisories/RUSTSEC-2026-0373.html'
  - url: 'https://github.com/rust-ammonia/ammonia/pull/267'
tags:
  - osv
  - rust
ingestedAt: '2026-10-18T11:51:09.860Z'
---

## Overview

URL filtering, such as relative URLs and URL scheme limits,
is not always applied when CSS sanitization is used.

When the inner URL is quoted, CSS `url("")` is matched case-sensitively,
when it should be matched case-insensitively.
As a result, while `url("")` gets the intended domain name filtering,
`URL("")` does not.

The following example shows how an application needs to be configured
to trigger this bug.

```rust
let mut builder = Builder::new();
// allow inline styles
builder.filter_style_properties(hashset!["background-image"]);
builder.add_generic_attributes(&["style"]);
// notice that "http" URLs aren't allowed
builder.url_schemes(["cid"].into());

// attacker-controlled, presumably
let cleaned = builder.clean(r#"<div style='background:URL("https://evil.com/ping");'>"#);

// this is the expected result
assert_eq!(String::from(&cleaned), r#"<div style="">ok</p>"#);

// this is the result that the vulnerable version actually gets
assert_eq!(String::from(&cleaned), r#"<div style="background-image:URL(&quot;https://evil.com/ping&quot;);">ok</p>"#);
```

This can be used to inject tracking pixels where the application intended to prevent them.
It does not allow XSS, and its usefulness for data exfiltration is limited.

---

This vulnerability was reported by [Louis Li](https://github.com/zhixuli0406).

## Affected packages

- `ammonia >= 4.2.0, < 4.2.4`

## Remediation

Upgrade to a patched release:

- `ammonia 4.2.4`