GHSA-69v2-w9vg-4g83
Incorrect escaping for `url("")` functions in CSS style attributes
In some cases, quotation marks in CSS url() functions are not escaped. This allows CSS injection. This feature is not enabled by default, so an application is vulnerable if, and only if, the style attribute is allowed and filter_style_properties is used.
As an example, this snippet:
<div style='background:url("cid:\");EVIL_CSS_HERE;background:url(\"cid:")'>
Would erroneously "sanitize" to:
<div style='background:url("cid:");EVIL_CSS_HERE;background:url("cid:")'>
This vulnerability was reported by Uttej Badwane
What each source reports
OSVRUSTSEC-2021-0157No score
Incorrect escaping for `url("")` functions in CSS style attributes
In some cases, quotation marks in CSS url() functions are not escaped. This allows CSS injection. This feature is not enabled by default, so an application is vulnerable if, and only if, the style attribute is allowed and filter_style_properties is used.
As an example, this snippet:
<div style='background:url("cid:\");EVIL_CSS_HERE;background:url(\"cid:")'>
Would erroneously "sanitize" to:
<div style='background:url("cid:");EVIL_CSS_HERE;background:url("cid:")'>
This vulnerability was reported by Uttej Badwane
- Record
RUSTSEC-2021-0157- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ammoniacrates.io | 0.0.0-0 up to 4.1.7, 4.2.0 up to 4.2.3 | 4.1.74.2.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-69v2-w9vg-4g83 is a vulnerability with no CVSS score yet in ammonia, published October 10, 2021. No source lists public exploit code. Fixed in ammonia 4.1.7.