Skip to contentSymfony Html-sanitizer vulnerabilities
- sensiolabs symfony, symfony html-sanitizer +1 moreSymfony: HtmlSanitizer URL Parser Deny Gates Underinclusive: Percent-Encoded BiDi Marks and Unicode Whitespace Bypass Visual-Spoofing DefenseCVE-2026-48760Fix available5.3 Medium
- sensiolabs symfony, symfony html-sanitizer +1 moreSymfony: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes on <object>, <applet>, <iframe>, <img> and the URL Inside <meta http-equiv="refresh"> contentCVE-2026-48761Fix available5.3 Medium
- sensiolabs symfony, symfony html-sanitizer +1 moreSymfony: HtmlSanitizer UrlAttributeSanitizer Omits action/formaction/poster/cite — javascript: URI Survives Sanitization (XSS)CVE-2026-45753Fix available2.1 Low
- sensiolabs symfony, symfony html-sanitizer +1 moreSymfony: HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URL-Parser Differentials and <area> MisclassificationCVE-2026-45066Fix available2.3 Low
- sensiolabs symfony, symfony html-sanitizer +1 moreSymfony: HtmlSanitizer URL Attributes Pass Through BiDi Override Characters → Visual href SpoofingCVE-2026-45064Fix available2.3 Low