- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 7 · 3 medium, 4 low
- Registry
- Packagist
Advisories 7
- CVE-2026-121949Low 2.3
Symfony: HtmlSanitizer Does Not URL-Sanitize srcset and imagesrcset: Media Scheme and Host Allow-List Bypass
Affected: from 6.1.0, fixed in 6.4.50; from 7.0.0, fixed in 7.4.23; from 8.0.0, fixed in 8.1.11.
- CVE-2026-121373Medium 5.3
Symfony: HtmlSanitizer MetaRefreshAttributeSanitizer Matches Only a Narrow Subset of the Browser Refresh Grammar (Incomplete Fix for…
Affected: from 6.1.0, fixed in 6.4.50; from 7.0.0, fixed in 7.4.23; from 8.0.0, fixed in 8.1.11.
- CVE-2026-48761Medium 5.3
Symfony: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes on <object>, <applet>, <iframe>, <img> and the URL Inside <meta…
Affected: from 6.1.0, fixed in 6.4.41; from 7.0.0, fixed in 7.4.13; from 8.0.0, fixed in 8.0.13.
- CVE-2026-48760Medium 5.3
Symfony: HtmlSanitizer URL Parser Deny Gates Underinclusive: Percent-Encoded BiDi Marks and Unicode Whitespace Bypass Visual-Spoofing…
Affected: from 6.1.0, fixed in 6.4.41; from 7.0.0, fixed in 7.4.13; from 8.0.0, fixed in 8.0.13.
- CVE-2026-45064Low 2.3
Symfony: HtmlSanitizer URL Attributes Pass Through BiDi Override Characters → Visual href Spoofing
Affected: from 6.1.0, fixed in 6.4.40; from 7.0.0, fixed in 7.4.12; from 8.0.0, fixed in 8.0.12.
- CVE-2026-45753Low 2.1
Symfony: HtmlSanitizer UrlAttributeSanitizer Omits action/formaction/poster/cite — javascript: URI Survives Sanitization (XSS)
Affected: from 6.1.0, fixed in 6.4.40; from 7.0.0, fixed in 7.4.12; from 8.0.0, fixed in 8.0.12.
- CVE-2026-45066Low 2.3
Symfony: HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URL-Parser Differentials and <area> Misclassification
Affected: from 6.1.0, fixed in 6.4.40; from 7.0.0, fixed in 7.4.12; from 8.0.0, fixed in 8.0.12.