Reported

October 10, 2021

Issued

October 12, 2026

Package

ammonia (crates.io)

Type

Vulnerability

Categories

• format-injection

Keywords

#html #clickjacking

Aliases

• GHSA-69v2-w9vg-4g83

References

• https://github.com/rust-ammonia/ammonia/pull/259

Patched

• >=4.2.3
• >=4.1.7, <4.2.0

Description

In some cases, quotation marks in CSS url() functions are not escaped. This allows CSS injection. This feature is not enabled by default, so an application is vulnerable if, and only if, the style attribute is allowed and filter_style_properties is used.

As an example, this snippet:

<div style='background:url("cid:\");EVIL_CSS_HERE;background:url(\"cid:")'>

Would erroneously "sanitize" to:

<div style='background:url("cid:");EVIL_CSS_HERE;background:url("cid:")'>

This vulnerability was reported by Uttej Badwane

Advisory available under CC0-1.0 license.