{"id":"CVE-2026-48761","aliases":["GHSA-x5qj-865h-mgvm"],"title":"Symfony: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes","summary":"Symfony: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes","severity":"medium","cwe":["CWE-79","CWE-1023"],"vendor":"symfony","product":"symfony/html-sanitizer","ecosystem":"composer","affected":["symfony/html-sanitizer >= 6.1.0, < 6.4.41","symfony/html-sanitizer >= 7.0.0, < 7.4.13","symfony/html-sanitizer >= 8.0.0, < 8.0.13","symfony/symfony >= 6.1.0, < 6.4.41","symfony/symfony >= 7.0.0, < 7.4.13","symfony/symfony >= 8.0.0, < 8.0.13"],"patched":["symfony/html-sanitizer 6.4.41","symfony/html-sanitizer 7.4.13","symfony/html-sanitizer 8.0.13","symfony/symfony 6.4.41","symfony/symfony 7.4.13","symfony/symfony 8.0.13"],"published":"2026-06-15","updated":"2026-06-15","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-x5qj-865h-mgvm","references":[{"url":"https://github.com/symfony/symfony/security/advisories/GHSA-x5qj-865h-mgvm"},{"url":"https://github.com/symfony/symfony/commit/069a70f9f26e61e9de3b7f9a864a86ed24b36bd0"},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/html-sanitizer/CVE-2026-48761.yaml"},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2026-48761.yaml"},{"url":"https://symfony.com/cve-2026-48761"},{"url":"https://github.com/advisories/GHSA-x5qj-865h-mgvm"}],"tags":["ghsa","composer"],"ingestedAt":"2026-07-07T15:41:58.955Z","epss":0.00345,"epssPercentile":0.28086,"slug":"CVE-2026-48761","body":"## Overview\n\n### Description\n\n`Symfony\\Component\\HtmlSanitizer\\Visitor\\AttributeSanitizer\\UrlAttributeSanitizer::getSupportedAttributes()` enumerates the attribute names whose values are scrubbed through `UrlSanitizer::sanitize()` (scheme and host allow-lists, `javascript:` rejection, BiDi check, etc.). The list is `['src', 'href', 'lowsrc', 'background', 'ping', 'action', 'formaction', 'poster', 'cite']`. Other URL-bearing attributes are absent: `