Vulnerability RUSTSEC-2021-0157

Unknown

5 years ago

Incorrect escaping for `url("")` functions in CSS style attributes

0.1.0 - 0.7.0 and 1.0.0 - 4.1.6

Summary

Incorrect escaping for `url("")` functions in CSS style attributes

Details

In some cases, quotation marks in CSS url() functions are not escaped. This allows CSS injection. This feature is not enabled by default, so an application is vulnerable if, and only if, the style attribute is allowed and filter_style_properties is used.

As an example, this snippet:

<div style='background:url("cid:\");EVIL_CSS_HERE;background:url(\"cid:")'>

Would erroneously "sanitize" to:

<div style='background:url("cid:");EVIL_CSS_HERE;background:url("cid:")'>

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Medium Risk

13 days ago

Ammonia: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

0.1.0 - 0.7.0 and 1.0.0 - 3.3.2 and 4.0.0 - 4.0.2 and 4.1.2 - 4.1.3 GHSA-m6mh-2hw2-555x

Unknown

2 months ago

XSS in ammonia via SVG `animate` and `set` animation tags

0.1.0 - 0.7.0 and 1.0.0 - 3.3.2 RUSTSEC-2026-0213

Unknown

3 months ago

mXSS in ammonia via MathML `annotation-xml` encoding strip

0.1.0 - 0.7.0 and 1.0.0 - 3.3.1 RUSTSEC-2026-0193

Low Risk

1 year ago

Ammonia incorrectly handles embedded SVG and MathML leading to mutation XSS after removal

0.1.0 - 0.7.0 and 1.0.0 - 3.3.0 and 4.0.0 and 4.1.0 - 4.1.1 GHSA-mm7x-qfjj-5g2c

Unknown

1 year ago

Incorrect handling of embedded SVG and MathML leads to mutation XSS after removal

0.1.0 - 0.7.0 and 1.0.0 - 3.3.0 RUSTSEC-2025-0071

View all vulnerabilities for these packages

Impacted packages

ammonia

Timeline

Published

5 years ago

Fixed (4.2.3)

1 day ago

Fixed (4.1.7)

1 day ago

Last Modified

7 hours ago