{"answers":{"affected":"1 open source package ship an affected version, including ammonia.","exploited":"There is no known exploitation of RUSTSEC-2026-0373 in the wild and no public exploit code.","fix":"Upgrade ammonia to a fixed version for your release line: 4.1.8 or 4.2.4.","what":"RUSTSEC-2026-0373 is a vulnerability in ammonia, published on 16 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for RUSTSEC-2026-0373 and fix it if it is affected.\n\nWhat it is: RUSTSEC-2026-0373 is a vulnerability in ammonia, published on 16 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of RUSTSEC-2026-0373 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- ammonia (crates.io): affected from 0.0.0-0; fixed in 4.1.8, 4.2.4\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/RUSTSEC-2026-0373/ (Markdown: https://insights.sbomify.com/RUSTSEC-2026-0373/index.md)","id":"RUSTSEC-2026-0373","markdown":"https://insights.sbomify.com/RUSTSEC-2026-0373/index.md","name":"RUSTSEC-2026-0373","record":{"aliases":["GHSA-x43w-36pp-96g3"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["security_bypass"],"network_reachable":"yes","non_default_config":true,"product_category":"Rust HTML sanitizer","requires_auth":"none","summary":"Attackers can bypass URL filtering in CSS sanitization by using uppercase URL schemes, allowing injection of tracking pixels or limited data exfiltration.","user_interaction":"not_required","vuln_class":"security_feature_bypass"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"URL filtering, such as relative URLs and URL scheme limits,\nis not always applied when CSS sanitization is used.\n\nWhen the inner URL is quoted, CSS `url(\"\")` is matched case-sensitively,\nwhen it should be matched case-insensitively.\nAs a result, while `url(\"\")` gets the intended domain name filtering,\n`URL(\"\")` does not.\n\nThe following example shows how an application needs to be configured\nto trigger this bug.\n\n```rust\nlet mut builder = Builder::new();\n// allow inline styles\nbuilder.filter_style_properties(hashset![\"background-image\"]);\nbuilder.add_generic_attributes(\u0026[\"style\"]);\n// notice that \"http\" URLs aren't allowed\nbuilder.url_schemes([\"cid\"].into());\n\n// attacker-controlled, presumably\nlet cleaned = builder.clean(r#\"\u003cdiv style='background:URL(\"https://evil.com/ping\");'\u003e\"#);\n\n// this is the expected result\nassert_eq!(String::from(\u0026cleaned), r#\"\u003cdiv style=\"\"\u003eok\u003c/p\u003e\"#);\n\n// this is the result that the vulnerable version actually gets\nassert_eq!(String::from(\u0026cleaned), r#\"\u003cdiv style=\"background-image:URL(\u0026quot;https://evil.com/ping\u0026quot;);\"\u003eok\u003c/p\u003e\"#);\n```\n\nThis can be used to inject tracking pixels where the application intended to prevent them.\nIt does not allow XSS, and its usefulness for data exfiltration is limited.\n\n---\n\nThis vulnerability was reported by [Louis Li](https://github.com/zhixuli0406).","ecosystems":["crates.io"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"Missing case-insensitive matching for CSS url function","id":"RUSTSEC-2026-0373","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"crates.io","product":null,"products":[],"type":"security_feature_bypass","year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"crates.io","fixed":["4.1.8","4.2.4"],"introduced":["0.0.0-0","4.2.0"],"last_affected":[],"package":"ammonia","purl":"pkg:cargo/ammonia","source":"RUSTSEC-2026-0373"}],"products":null,"published":"2026-10-16","related":[],"sources":[{"class":"open","licence":"CC0 1.0","name":"RustSec","prefix":"RUSTSEC"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Attackers can bypass URL filtering in CSS sanitization by using uppercase URL schemes, allowing injection of tracking pixels or limited data exfiltration.","url":"https://insights.sbomify.com/RUSTSEC-2026-0373/"}