Security
فارسی
All products

symfony/html-sanitizer

Composer · Package
8 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
Symfony: HtmlSanitizer URL Parser Deny Gates Underinclusive: Percent-Encoded BiDi Marks and Unicode Whitespace Bypass Visual-Spoofing DefenseCVE-2026-48760 · GHSA-V3WM-QF9P-C549Version ranges need review. symfony/html-sanitizersymfony/symfony Composer Medium Fix reported
Symfony's HtmlSanitizer UrlAttributeSanitizer Omits action/formaction/poster/cite — `javascript`: URI Survives Sanitization (XSS)CVE-2026-45753 · GHSA-HHG7-C65M-H7FFVersion ranges need review. symfony/html-sanitizersymfony/symfony Composer Low Fix reported
Symfony's HtmlSanitizer URL Attributes Pass Through BiDi Override Characters → Visual href SpoofingCVE-2026-45064 · GHSA-H5VQ-QFCG-4M6PVersion ranges need review. symfony/html-sanitizersymfony/symfony Composer Medium Fix reported
Symfony: HtmlSanitizer UrlAttributeSanitizer Misses URL AttributesCVE-2026-48761 · GHSA-X5QJ-865H-MGVMVersion ranges need review. symfony/html-sanitizersymfony/symfony Composer Medium Fix reported
Symfony has an HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URL-Parser Differentials and <area> MisclassificationCVE-2026-45066 · GHSA-QC95-4862-92FHVersion ranges need review. symfony/html-sanitizersymfony/symfony Composer Medium Fix reported
HtmlSanitizer MetaRefreshAttributeSanitizer Matches Only a Narrow Subset of the Browser Refresh Grammar: Incomplete Fix for CVE-2026-48761PKSA-4Z5Q-Y2W8-BWQQ symfony/html-sanitizer Composer Unknown No fix reported
HtmlSanitizer Does Not URL-Sanitize srcset and imagesrcset: Media Scheme and Host Allow-List BypassPKSA-WWNC-RWY3-V11M symfony/html-sanitizer Composer Unknown No fix reported
CVE-2026-118517: HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URLs Without a Well-Formed Authority: Incomplete Fix for CVE-2026-45066CVE-2026-118517 · PKSA-66ZQ-5HKY-MBZT symfony/html-sanitizersymfony/symfony Composer Unknown No fix reported