XSS Vulnerabilities in Symfony PHP Framework
CVE-2026-48761
5.3MEDIUM
What is CVE-2026-48761?
The Symfony PHP framework is affected by a vulnerability that allows attackers to inject malicious scripts into sanitized output. This issue arises due to the improper handling of URL-bearing attributes in various HTML elements, such as , , , and , as well as URLs, which bypass URL sanitization. As a result, explicitly enabled elements or attributes can provide unsanitized access to dangerous payloads, including JavaScript. Users are advised to upgrade to the patched versions 6.4.41, 7.4.13, and 8.0.13 to mitigate this risk effectively.
Affected Version(s)
html-sanitizer >= 6.1.0, < 6.4.41 < 6.1.0, 6.4.41
html-sanitizer >= 7.0.0-BETA1, < 7.4.13 < 7.0.0-BETA1, 7.4.13
html-sanitizer >= 8.0.0-BETA1, < 8.0.13 < 8.0.0-BETA1, 8.0.13