CVE-2026-48761Medium▾ SunlitSymfony: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes
▾ Sunlit zone — Low / medium · no exploitation signal
impact 27.5 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 15.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
0.4%
Symfony\Component\HtmlSanitizer\Visitor\AttributeSanitizer\UrlAttributeSanitizer::getSupportedAttributes() enumerates the attribute names whose values are scrubbed through UrlSanitizer::sanitize() (scheme and host allow-lists, javascript: rejection, BiDi check, etc.). The list is ['src', 'href', 'lowsrc', 'background', 'ping', 'action', 'formaction', 'poster', 'cite']. Other URL-bearing attributes are absent: <object data=…>, <applet codebase=…>, <applet archive=…> and <object archive=…>, <iframe longdesc=…> and <img longdesc=…>. When an integrator opts these elements/attributes in via allowElement('object', ['data']), allowElement('applet', ['codebase']), etc., or via allowAttribute(), no URL sanitization runs: data="javascript:alert(1)" and similar payloads ship through unchanged into the output, enabling stored XSS.
<meta http-equiv="refresh" content="0; url=…"> is the same class of bug routed differently: the URL is embedded inside a multi-field content attribute that the per-attribute sanitizer cannot detect from the attribute name alone. Integrators who enable <meta> with the content attribute (e.g. via allowStaticElements()) see content="0; url=javascript:alert(1)" pass through, producing a refresh-driven navigation to a javascript: URL.
Default configurations are not affected: <object>, <applet> and <iframe> are not in W3CReference::BODY_ELEMENTS and <meta> requires an explicit opt-in to <head> context. The vulnerability surface is integrators who explicitly allow any of those elements together with the listed URL-bearing attributes.
UrlAttributeSanitizer now also routes data, codebase, archive and longdesc through UrlSanitizer::sanitize(). A new MetaRefreshAttributeSanitizer registered as a default attribute sanitizer detects the <delay>; url=<url> syntax inside <meta content>, sanitizes the embedded URL, and drops the attribute if the URL is rejected; non-refresh meta content values are passed through unchanged.
The patches for this issue are available here for branch 6.4 (and forward-ported to 7.4, 8.0 and 8.1).
Symfony would like to thank Scott Arciszewski (Trail of Bits) for reporting the issue and Nicolas Grekas for providing the fix.
symfony/html-sanitizer >= 6.1.0, < 6.4.41symfony/html-sanitizer >= 7.0.0, < 7.4.13symfony/html-sanitizer >= 8.0.0, < 8.0.13symfony/symfony >= 6.1.0, < 6.4.41symfony/symfony >= 7.0.0, < 7.4.13symfony/symfony >= 8.0.0, < 8.0.13Upgrade to a patched release:
symfony/html-sanitizer 6.4.41symfony/html-sanitizer 7.4.13symfony/html-sanitizer 8.0.13symfony/symfony 6.4.41symfony/symfony 7.4.13symfony/symfony 8.0.13Connected by shared product, vendor, weakness, or advisory.
CVE-2026-48760MediumSymfony: HtmlSanitizer URL Parser Deny Gates Underinclusive: Percent-Encoded BiDi Marks and Unicode Whitespace Bypass Visual-Spoofing Defense
CVE-2026-49210Mediumsymfony/ux-live-component: XSS via attacker-controlled child component tag
CVE-2026-49216Mediumsymfony/ux-autocomplete: XSS via unescaped AJAX response data
CVE-2026-55877Medium· 6.1symfony/ux-icons: XSS via unsanitized SVG content in local files and Iconify on-demand responses
CVE-2026-54181Medium· 5.4backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels
CVE-2021-41164High· 8.2CKEditor4 is an open source WYSIWYG HTML editor