GHSA-x5qj-865h-mgvm
Suggest an improvement- Source
- https://github.com/advisories/GHSA-x5qj-865h-mgvm
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-x5qj-865h-mgvm/GHSA-x5qj-865h-mgvm.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-x5qj-865h-mgvm
- Aliases
- Published
- 2026-06-15T16:46:53Z
- Modified
- 2026-09-10T03:50:51Z
- Severity
-
- 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N CVSS Calculator
- Summary
- Symfony: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes
- Details
-
Description
Symfony\Component\HtmlSanitizer\Visitor\AttributeSanitizer\UrlAttributeSanitizer::getSupportedAttributes()enumerates the attribute names whose values are scrubbed throughUrlSanitizer::sanitize()(scheme and host allow-lists,javascript:rejection, BiDi check, etc.). The list is['src', 'href', 'lowsrc', 'background', 'ping', 'action', 'formaction', 'poster', 'cite']. Other URL-bearing attributes are absent:<object data=…>,<applet codebase=…>,<applet archive=…>and<object archive=…>,<iframe longdesc=…>and<img longdesc=…>. When an integrator opts these elements/attributes in viaallowElement('object', ['data']),allowElement('applet', ['codebase']), etc., or viaallowAttribute(), no URL sanitization runs:data="javascript:alert(1)"and similar payloads ship through unchanged into the output, enabling stored XSS.<meta http-equiv="refresh" content="0; url=…">is the same class of bug routed differently: the URL is embedded inside a multi-fieldcontentattribute that the per-attribute sanitizer cannot detect from the attribute name alone. Integrators who enable<meta>with thecontentattribute (e.g. viaallowStaticElements()) seecontent="0; url=javascript:alert(1)"pass through, producing a refresh-driven navigation to ajavascript:URL.Default configurations are not affected:
<object>,<applet>and<iframe>are not inW3CReference::BODY_ELEMENTSand<meta>requires an explicit opt-in to<head>context. The vulnerability surface is integrators who explicitly allow any of those elements together with the listed URL-bearing attributes.Resolution
UrlAttributeSanitizernow also routesdata,codebase,archiveandlongdescthroughUrlSanitizer::sanitize(). A newMetaRefreshAttributeSanitizerregistered as a default attribute sanitizer detects the<delay>; url=<url>syntax inside<meta content>, sanitizes the embedded URL, and drops the attribute if the URL is rejected; non-refresh metacontentvalues are passed through unchanged.The patches for this issue are available here for branch 6.4 (and forward-ported to 7.4, 8.0 and 8.1).
Credits
Symfony would like to thank Scott Arciszewski (Trail of Bits) for reporting the issue and Nicolas Grekas for providing the fix.
- Database specific
{ "cwe_ids": [ "CWE-1023", "CWE-79" ], "github_reviewed": true, "github_reviewed_at": "2026-06-15T16:46:53Z", "nvd_published_at": null, "severity": "MODERATE" }- References
-
- https://github.com/symfony/symfony/security/advisories/GHSA-x5qj-865h-mgvm
- https://github.com/symfony/symfony/commit/069a70f9f26e61e9de3b7f9a864a86ed24b36bd0
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/html-sanitizer/CVE-2026-48761.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2026-48761.yaml
- https://github.com/symfony/symfony
- https://symfony.com/cve-2026-48761
Affected packages
Packagist
symfony/html-sanitizer
Package
- Name
- symfony/html-sanitizer
- Purl
- pkg:composer/symfony/html-sanitizer
Affected versions
v6.*
symfony/html-sanitizer
Package
- Name
- symfony/html-sanitizer
- Purl
- pkg:composer/symfony/html-sanitizer
Affected versions
v7.*
symfony/html-sanitizer
Package
- Name
- symfony/html-sanitizer
- Purl
- pkg:composer/symfony/html-sanitizer
symfony/symfony
Package
- Name
- symfony/symfony
- Purl
- pkg:composer/symfony/symfony
Affected versions
v6.*
symfony/symfony
Package
- Name
- symfony/symfony
- Purl
- pkg:composer/symfony/symfony
Affected versions
v7.*
symfony/symfony
Package
- Name
- symfony/symfony
- Purl
- pkg:composer/symfony/symfony