{"id":"GHSA-x43w-36pp-96g3","aliases":["RUSTSEC-2026-0373"],"status":"published","title":"Missing case-insensitive matching for CSS url function","description":"URL filtering, such as relative URLs and URL scheme limits,\nis not always applied when CSS sanitization is used.\n\nWhen the inner URL is quoted, CSS `url(\"\")` is matched case-sensitively,\nwhen it should be matched case-insensitively.\nAs a result, while `url(\"\")` gets the intended domain name filtering,\n`URL(\"\")` does not.\n\nThe following example shows how an application needs to be configured\nto trigger this bug.\n\n```rust\nlet mut builder = Builder::new();\n// allow inline styles\nbuilder.filter_style_properties(hashset![\"background-image\"]);\nbuilder.add_generic_attributes(\u0026[\"style\"]);\n// notice that \"http\" URLs aren't allowed\nbuilder.url_schemes([\"cid\"].into());\n\n// attacker-controlled, presumably\nlet cleaned = builder.clean(r#\"\u003cdiv style='background:URL(\"https://evil.com/ping\");'\u003e\"#);\n\n// this is the expected result\nassert_eq!(String::from(\u0026cleaned), r#\"\u003cdiv style=\"\"\u003eok\u003c/p\u003e\"#);\n\n// this is the result that the vulnerable version actually gets\nassert_eq!(String::from(\u0026cleaned), r#\"\u003cdiv style=\"background-image:URL(\u0026quot;https://evil.com/ping\u0026quot;);\"\u003eok\u003c/p\u003e\"#);\n```\n\nThis can be used to inject tracking pixels where the application intended to prevent them.\nIt does not allow XSS, and its usefulness for data exfiltration is limited.\n\n---\n\nThis vulnerability was reported by [Louis Li](https://github.com/zhixuli0406).","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2026-10-16T12:00:00Z","modified":"2026-10-17T15:30:02Z","fixes":[{"ecosystem":"crates.io","package":"ammonia","fixed_in":["4.1.8","4.2.4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"crates.io","package":"ammonia","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"4.1.8"},{"introduced":"4.2.0"},{"fixed":"4.2.4"}]}]}],"references":[{"url":"https://crates.io/crates/ammonia","tags":["package"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0373.html","tags":["advisory"]},{"url":"https://github.com/rust-ammonia/ammonia/pull/267","tags":["web"]}],"sources":{"osv":[{"id":"RUSTSEC-2026-0373","title":"Missing case-insensitive matching for CSS url function","description":"URL filtering, such as relative URLs and URL scheme limits,\nis not always applied when CSS sanitization is used.\n\nWhen the inner URL is quoted, CSS `url(\"\")` is matched case-sensitively,\nwhen it should be matched case-insensitively.\nAs a result, while `url(\"\")` gets the intended domain name filtering,\n`URL(\"\")` does not.\n\nThe following example shows how an application needs to be configured\nto trigger this bug.\n\n```rust\nlet mut builder = Builder::new();\n// allow inline styles\nbuilder.filter_style_properties(hashset![\"background-image\"]);\nbuilder.add_generic_attributes(\u0026[\"style\"]);\n// notice that \"http\" URLs aren't allowed\nbuilder.url_schemes([\"cid\"].into());\n\n// attacker-controlled, presumably\nlet cleaned = builder.clean(r#\"\u003cdiv style='background:URL(\"https://evil.com/ping\");'\u003e\"#);\n\n// this is the expected result\nassert_eq!(String::from(\u0026cleaned), r#\"\u003cdiv style=\"\"\u003eok\u003c/p\u003e\"#);\n\n// this is the result that the vulnerable version actually gets\nassert_eq!(String::from(\u0026cleaned), r#\"\u003cdiv style=\"background-image:URL(\u0026quot;https://evil.com/ping\u0026quot;);\"\u003eok\u003c/p\u003e\"#);\n```\n\nThis can be used to inject tracking pixels where the application intended to prevent them.\nIt does not allow XSS, and its usefulness for data exfiltration is limited.\n\n---\n\nThis vulnerability was reported by [Louis Li](https://github.com/zhixuli0406).","status":"published","published":"2026-10-16T12:00:00Z","modified":"2026-10-17T15:30:02.378211969Z","updated_at":"2026-11-02T15:53:40.430679Z"}]}}