rustsec-2026-0373

debian_rustsec
Description

URL filtering, such as relative URLs and URL scheme limits, is not always applied when CSS sanitization is used. When the inner URL is quoted, CSS `url("")` is matched case-sensitively, when it should be matched case-insensitively. As a result, while `url("")` gets the intended domain name filtering, `URL("")` does not. The following example shows how an application needs to be configured to trigger this bug. ```rust let mut builder = Builder::new(); // allow inline styles builder.filter_style_properties(hashset!["background-image"]); builder.add_generic_attributes(&["style"]); // notice that "http" URLs aren't allowed builder.url_schemes(["cid"].into()); // attacker-controlled, presumably let cleaned = builder.clean(r#"<div style='background:URL("https://evil.com/ping");'>"#); // this is the expected result assert_eq!(String::from(&cleaned), r#"<div style="">ok</p>"#); // this is the result that the vulnerable version actually gets assert_eq!(String::from(&cleaned), r#"<div style="background-image:URL(&quot;https://evil.com/ping&quot;);">ok</p>"#); ``` This can be used to inject tracking pixels where the application intended to prevent them. It does not allow XSS, and its usefulness for data exfiltration is limited. --- This vulnerability was reported by [Louis Li](https://github.com/zhixuli0406).

Timeline
Published
unknown
Last Modified
unknown
CVSS Details

CVSS details not available.

Affected Products

No product information available.

References

No references available.

Linked Vulnerabilities

No linked vulnerabilities found.

{
  "aliases": [
    "GHSA-x43w-36pp-96g3"
  ],
  "categories": [
    "format-injection"
  ],
  "crate": "ammonia",
  "cves": [],
  "cvss": 0.0,
  "database_specific": {
    "severity": ""
  },
  "date": "2026-10-16",
  "deb_packages": [
    {
      "crate_name": "ammonia",
      "deb_name": "librust-ammonia-dev",
      "version": "4.2.3-1"
    }
  ],
  "description": "URL filtering, such as relative URLs and URL scheme limits,\nis not always applied when CSS sanitization is used.\n\nWhen the inner URL is quoted, CSS `url(\"\")` is matched case-sensitively,\nwhen it should be matched case-insensitively.\nAs a result, while `url(\"\")` gets the intended domain name filtering,\n`URL(\"\")` does not.\n\nThe following example shows how an application needs to be configured\nto trigger this bug.\n\n```rust\nlet mut builder = Builder::new();\n// allow inline styles\nbuilder.filter_style_properties(hashset![\"background-image\"]);\nbuilder.add_generic_attributes(&[\"style\"]);\n// notice that \"http\" URLs aren't allowed\nbuilder.url_schemes([\"cid\"].into());\n\n// attacker-controlled, presumably\nlet cleaned = builder.clean(r#\"<div style='background:URL(\"https://evil.com/ping\");'>\"#);\n\n// this is the expected result\nassert_eq!(String::from(&cleaned), r#\"<div style=\"\">ok</p>\"#);\n\n// this is the result that the vulnerable version actually gets\nassert_eq!(String::from(&cleaned), r#\"<div style=\"background-image:URL(&quot;https://evil.com/ping&quot;);\">ok</p>\"#);\n```\n\nThis can be used to inject tracking pixels where the application intended to prevent them.\nIt does not allow XSS, and its usefulness for data exfiltration is limited.\n\n---\n\nThis vulnerability was reported by [Louis Li](https://github.com/zhixuli0406).",
  "id": "RUSTSEC-2026-0373",
  "keywords": [
    "css",
    "html"
  ],
  "patched_versions": [
    ">=4.2.4",
    ">=4.1.8, <4.2.0"
  ],
  "source": "debian_rustsec",
  "title": "Missing case-insensitive matching for CSS url function",
  "url": "https://github.com/rust-ammonia/ammonia/pull/267"
}
View JSON API Download JSON