RUSTSEC-2021-0157 GHSA-69v2-w9vg-4g83

Incorrect escaping for `url("")` functions in CSS style attributes

Not rated yet crates.io

Severity: Not rated yet; No source has published a CVSS score yet
Exploit chance (EPSS): —; No score published
Known exploited: No; Not in CISA's catalog
Weakness: —; Not classified
Fix: 4.2.3; Upgrade ammonia to this version or later

Description

In some cases, quotation marks in CSS url() functions are not escaped. This allows CSS injection. This feature is not enabled by default, so an application is vulnerable if, and only if, the style attribute is allowed and filter_style_properties is used.

As an example, this snippet:

<div style='background:url("cid:\");EVIL_CSS_HERE;background:url(\"cid:")'>

Would erroneously "sanitize" to:

<div style='background:url("cid:");EVIL_CSS_HERE;background:url("cid:")'>

This vulnerability was reported by Uttej Badwane

Affected versions

crates.io

Package	Vulnerable	Fixed in
ammonia	`>= 0.0.0-0, < 4.1.7` `>= 4.2.0, < 4.2.3`	`4.1.7` `4.2.3`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

ammonia crates.io → `4.2.3`

cargo

cargo update -p ammonia --precise 4.2.3

References

Advisories

rustsec.org/advisories/RUSTSEC-2021-0157.html

Packages

crates.io/crates/ammonia

Timeline

Oct 10, 2021 Published
Oct 12, 2026 Last updated by the source

Advisory	Severity	Why it's related
RUSTSEC-2026-0373 Missing case-insensitive matching for CSS url function	Not rated yet	Also affects ammonia
GHSA-m6mh-2hw2-555x Ammonia: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')	Medium	Also affects ammonia
GHSA-9jh8-v38h-cvhr ammonia: mXSS via MathML `annotation-xml` encoding strip	Medium	Also affects ammonia
GHSA-mm7x-qfjj-5g2c Ammonia incorrectly handles embedded SVG and MathML leading to mutation XSS after removal	Low	Also affects ammonia
GHSA-p2g9-94wh-65c2 Space bug in `clean_text`	Medium	Also affects ammonia
RUSTSEC-2021-0158 XSS in ammonia via SVG `animateMotion`, `animateTransform`, and/or `animateColor` tags	Not rated yet	Also affects ammonia
GHSA-5325-xw5m-phm3 Cross-site Scripting in ammonia	Medium	Also affects ammonia
GHSA-5hp8-35wj-m525 Uncontrolled recursion in ammonia	High	Also affects ammonia

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor