Search for packages
| purl | pkg:composer/symfony/html-sanitizer@7.3.2 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-v3wm-qf9p-c549
Aliases: CVE-2026-48760 |
Symfony: HtmlSanitizer URL Parser Deny Gates Underinclusive: Percent-Encoded BiDi Marks and Unicode Whitespace Bypass Visual-Spoofing Defense ### Description `Symfony\Component\HtmlSanitizer\TextSanitizer\UrlSanitizer::parse()` rejects … |
Not vulnerable |
|
GHSA-x5qj-865h-mgvm
Aliases: CVE-2026-48761 |
Symfony: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes ### Description `Symfony\Component\HtmlSanitizer\Visitor\AttributeSanitizer\UrlAttributeSanitizer::getSupportedAttributes()` enumerates the attribute names whose values are scrubbed through `UrlSanitizer::sanitize()` (scheme … |
Not vulnerable |
|
GHSA-h5vq-qfcg-4m6p
Aliases: CVE-2026-45064 |
Symfony's HtmlSanitizer URL Attributes Pass Through BiDi Override Characters → Visual href Spoofing ### Description `Symfony\Component\HtmlSanitizer\TextSanitizer\UrlSanitizer::parse()` (used by `UrlSanitizer::sanitize()` and … |
Vulnerable |
|
GHSA-hhg7-c65m-h7ff
Aliases: CVE-2026-45753 |
Symfony's HtmlSanitizer UrlAttributeSanitizer Omits action/formaction/poster/cite — `javascript`: URI Survives Sanitization (XSS) ### Description `symfony/html-sanitizer` lets applications sanitise untrusted HTML. `UrlAttributeSanitizer` … |
Vulnerable |
|
GHSA-qc95-4862-92fh
Aliases: CVE-2026-45066 |
Symfony has an HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URL-Parser Differentials and <area> Misclassification ### Description `symfony/html-sanitizer` lets applications sanitise … |
Vulnerable |