Search for packages
| purl | pkg:composer/symfony/html-sanitizer@7.4.12 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-v3wm-qf9p-c549
Aliases: CVE-2026-48760 |
Symfony: HtmlSanitizer URL Parser Deny Gates Underinclusive: Percent-Encoded BiDi Marks and Unicode Whitespace Bypass Visual-Spoofing Defense ### Description `Symfony\Component\HtmlSanitizer\TextSanitizer\UrlSanitizer::parse()` rejects … |
Not vulnerable |
|
GHSA-x5qj-865h-mgvm
Aliases: CVE-2026-48761 |
Symfony: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes ### Description `Symfony\Component\HtmlSanitizer\Visitor\AttributeSanitizer\UrlAttributeSanitizer::getSupportedAttributes()` enumerates the attribute names whose values are scrubbed through `UrlSanitizer::sanitize()` (scheme … |
Not vulnerable |
| Advisory | Summary | Aliases |
|---|---|---|
|
GHSA-h5vq-qfcg-4m6p
|
Symfony's HtmlSanitizer URL Attributes Pass Through BiDi Override Characters → Visual href Spoofing ### Description `Symfony\Component\HtmlSanitizer\TextSanitizer\UrlSanitizer::parse()` (used by `UrlSanitizer::sanitize()` and … |
CVE-2026-45064
|
|
GHSA-hhg7-c65m-h7ff
|
Symfony's HtmlSanitizer UrlAttributeSanitizer Omits action/formaction/poster/cite — `javascript`: URI Survives Sanitization (XSS) ### Description `symfony/html-sanitizer` lets applications sanitise untrusted HTML. `UrlAttributeSanitizer` … |
CVE-2026-45753
|
|
GHSA-qc95-4862-92fh
|
Symfony has an HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URL-Parser Differentials and <area> Misclassification ### Description `symfony/html-sanitizer` lets applications sanitise … |
CVE-2026-45066
|