Missing case-insensitive matching for CSS url function

URL filtering, such as relative URLs and URL scheme limits, is not always applied when CSS sanitization is used. When the inner URL is quoted, CSS `url("")` is matched case-sensitively, when it should be matched case-insensitively. As a result, while `url("")` gets the intended domain name filtering, `URL("")` does not. The following example shows how an application needs to be configured to trigger this bug. ```rust let mut builder = Builder::new(); // allow inline styles builder.filter_style_properties(hashset!["background-image"]); builder.add_generic_attributes(&["style"]); // notice that "http" URLs aren't allowed builder.url_schemes(["cid"].into()); // attacker-controlled, presumably let cleaned = builder.clean(r#"<div style='background:URL("https://evil.com/ping");'>"#); // this is the expected result assert_eq!(String::from(&cleaned), r#"<div style="">ok</p>"#); // this is the result that the vulnerable version actually gets assert_eq!(String::from(&cleaned), r#"<div style="background-image:URL(&quot;https://evil.com/ping&quot;);">ok</p>"#); ``` This can be used to inject tracking pixels where the application intended to prevent them. It does not allow XSS, and its usefulness for data exfiltration is limited. --- This vulnerability was reported by [Louis Li](https://github.com/zhixuli0406).

Source published

16 Oct 2026 12:00:00 UTC

Source modified

17 Oct 2026 15:30:02 UTC

Observed here

24 Oct 2026 13:19:54 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.