symfony/html-sanitizer vulnerabilities (Packagist)
5 vulnerabilities.
symfony/html-sanitizerPackagistSymfony: HtmlSanitizer URL Parser Deny Gates Underinclusive: Percent-Encoded BiDi Marks and Unicode Whitespace Bypass Visual-Spoofing Defense5.3 Mediumsymfony/html-sanitizerPackagistSymfony: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes on <object>, <applet>, <iframe>, <img> and the URL Inside <meta http-equiv="refresh"> content5.3 Mediumsymfony/html-sanitizerPackagistSymfony: HtmlSanitizer UrlAttributeSanitizer Omits action/formaction/poster/cite — javascript: URI Survives Sanitization (XSS)2.1 Lowsymfony/html-sanitizerPackagistSymfony: HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URL-Parser Differentials and <area> Misclassification2.3 Lowsymfony/html-sanitizerPackagistSymfony: HtmlSanitizer URL Attributes Pass Through BiDi Override Characters → Visual href Spoofing2.3 Low