--- id: CVE-2026-48761 aliases: - GHSA-x5qj-865h-mgvm title: 'Symfony: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes' summary: 'Symfony: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes' severity: medium cwe: - CWE-79 - CWE-1023 vendor: symfony product: symfony/html-sanitizer ecosystem: composer affected: - 'symfony/html-sanitizer >= 6.1.0, < 6.4.41' - 'symfony/html-sanitizer >= 7.0.0, < 7.4.13' - 'symfony/html-sanitizer >= 8.0.0, < 8.0.13' - 'symfony/symfony >= 6.1.0, < 6.4.41' - 'symfony/symfony >= 7.0.0, < 7.4.13' - 'symfony/symfony >= 8.0.0, < 8.0.13' patched: - symfony/html-sanitizer 6.4.41 - symfony/html-sanitizer 7.4.13 - symfony/html-sanitizer 8.0.13 - symfony/symfony 6.4.41 - symfony/symfony 7.4.13 - symfony/symfony 8.0.13 published: '2026-06-15' updated: '2026-06-15' source: GHSA sourceUrl: 'https://github.com/advisories/GHSA-x5qj-865h-mgvm' references: - url: 'https://github.com/symfony/symfony/security/advisories/GHSA-x5qj-865h-mgvm' - url: >- https://github.com/symfony/symfony/commit/069a70f9f26e61e9de3b7f9a864a86ed24b36bd0 - url: >- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/html-sanitizer/CVE-2026-48761.yaml - url: >- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2026-48761.yaml - url: 'https://symfony.com/cve-2026-48761' - url: 'https://github.com/advisories/GHSA-x5qj-865h-mgvm' tags: - ghsa - composer ingestedAt: '2026-07-07T15:41:58.955Z' epss: 0.00345 epssPercentile: 0.2517 --- ## Overview ### Description `Symfony\Component\HtmlSanitizer\Visitor\AttributeSanitizer\UrlAttributeSanitizer::getSupportedAttributes()` enumerates the attribute names whose values are scrubbed through `UrlSanitizer::sanitize()` (scheme and host allow-lists, `javascript:` rejection, BiDi check, etc.). The list is `['src', 'href', 'lowsrc', 'background', 'ping', 'action', 'formaction', 'poster', 'cite']`. Other URL-bearing attributes are absent: `