GHSA-hhg7-c65m-h7ff
Suggest an improvement- Source
- https://github.com/advisories/GHSA-hhg7-c65m-h7ff
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-hhg7-c65m-h7ff/GHSA-hhg7-c65m-h7ff.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-hhg7-c65m-h7ff
- Aliases
-
- CVE-2026-45753
- Published
- 2026-05-28T16:43:27Z
- Modified
- 2026-05-28T17:00:10.163459162Z
- Severity
-
- 1.2 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U CVSS Calculator
- Summary
- Symfony's HtmlSanitizer UrlAttributeSanitizer Omits action/formaction/poster/cite — `javascript`: URI Survives Sanitization (XSS)
- Details
-
Description
symfony/html-sanitizerlets applications sanitise untrusted HTML.UrlAttributeSanitizeris the visitor responsible for validating URL-valued attributes and stripping dangerous schemes from them; it runs on every element regardless of configuration. Whether an attribute is kept is decided by the element/attribute allow-list; validating the scheme of a URL attribute is solelyUrlAttributeSanitizer's responsibility.UrlAttributeSanitizer::getSupportedAttributes()returned only['src', 'href', 'lowsrc', 'background', 'ping']. The HTML URL-valued attributesaction(<form>),formaction(<button>,<input type=image>),poster(<video>) andcite(<blockquote>,<q>,<del>,<ins>) were missing from that list, soDomVisitornever invoked scheme validation for them. As a result, when a configuration admits one of those attributes, ajavascript:URI in it survived sanitisation.Conditions for exploitation
allowSafeElements()is not affected:<form>and theformactionattribute are both flagged unsafe inW3CReference, andallowElement('form')resets the element's attribute list. Reaching the vulnerable attributes requires a deliberately permissive configuration, for example:<form>+action:allowElement('form', '*'),allowElement('form', ['action', …]),allowElement('form')->allowAttribute('action', 'form'), or theallowStaticElements()preset (whose docblock already warns the output "may still contain other dangerous behaviors");<button>/<input type=image>+formaction:allowElement(…, '*'),allowAttribute('formaction', …), orallowStaticElements();<blockquote>/<q>/<del>/<ins>+cite, or<video>+poster: similarly via'*',allowAttribute(), orallowStaticElements().
For the
action/formactioncases the victim must additionally submit the form or click the button.Resolution
UrlAttributeSanitizernow also handlesaction,formaction,citeandposter.action/formaction/citeare validated against the link schemes (like<a href>, sojavascript:is rejected anddata:is dropped too);posteris validated against the media schemes (sodata:images keep working). The behaviour of<a href>and<img src>is unchanged.One behaviour change to be aware of: a relative
action="/submit"on an allowed<form>is now dropped by default (the same as<a href>/<img src>today);->allowRelativeLinks()re-enables it.The patch for this issue is available here for branch 6.4.
Credits
Symfony would like to thank Himanshu Anand and Rémi Pelloux for reporting the issue and Nicolas Grekas for providing the fix.
- Database specific
{ "cwe_ids": [ "CWE-79", "CWE-184" ], "github_reviewed": true, "github_reviewed_at": "2026-05-28T16:43:27Z", "nvd_published_at": null, "severity": "LOW" }- References
-
- https://github.com/symfony/symfony/security/advisories/GHSA-hhg7-c65m-h7ff
- https://github.com/symfony/symfony/commit/26a598fcfc4f903cc55ff202f642ee621839825e
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/html-sanitizer/CVE-2026-45753.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2026-45753.yaml
- https://github.com/symfony/symfony
- https://symfony.com/cve-2026-45753
Affected packages
Packagist
symfony/html-sanitizer
Package
- Name
- symfony/html-sanitizer
- Purl
- pkg:composer/symfony%2Fhtml-sanitizer
symfony/html-sanitizer
Package
- Name
- symfony/html-sanitizer
- Purl
- pkg:composer/symfony%2Fhtml-sanitizer
symfony/html-sanitizer
Package
- Name
- symfony/html-sanitizer
- Purl
- pkg:composer/symfony%2Fhtml-sanitizer
symfony/symfony
Package
- Name
- symfony/symfony
- Purl
- pkg:composer/symfony%2Fsymfony
Affected versions
v6.*
symfony/symfony
Package
- Name
- symfony/symfony
- Purl
- pkg:composer/symfony%2Fsymfony