CVE-2026-45753: Symfony HtmlSanitizer XSS via incomplete URL attribute list

CVE-2026-45753 · Severity: medium · CVSS 4 · Published 2026-07-14

A vulnerability exists in the Symfony PHP framework's HTML sanitization component, which is used to clean user-provided content to prevent malicious code execution. Due to an incomplete list of protected attributes, certain URL-based fields like form actions or video posters may not be properly cleaned. This could allow an attacker to inject malicious scripts that execute in a victim's browser when they interact with the affected page, potentially leading to unauthorized actions or data theft.

Technologies: symfony/html-sanitizer (Packagist), symfony/symfony (Packagist), Symfony HtmlSanitizer. Vendors: Packagist, Symfony.

Quick answers

Is CVE-2026-45753 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-45753 being exploited in the wild.
How severe is CVE-2026-45753?
Medium severity, with a CVSS score of 4, published 14 July 2026.
Which products and versions are affected?
symfony/html-sanitizer (Packagist) ECOSYSTEM:introduced=6.1.0,fixed=6.4.40; symfony/symfony (Packagist) ECOSYSTEM:introduced=6.1.0,fixed=6.4.40; Symfony HtmlSanitizer >= 6.1.0, < 6.4.40; >= 7.0.0, < 7.4.12; >= 8.0.0, < 8.0.12.
Is there a fix for CVE-2026-45753?
Yes. symfony/html-sanitizer (Packagist): upgrade to 6.4.40 or later; symfony/symfony (Packagist): upgrade to 6.4.40 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45753 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-45753?
Check whether you run symfony/html-sanitizer (Packagist), symfony/symfony (Packagist) or Symfony HtmlSanitizer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • symfony/html-sanitizer (Packagist): upgrade to 6.4.40 or later
    composer require symfony/html-sanitizer:^6.4.40
  • symfony/symfony (Packagist): upgrade to 6.4.40 or later
    composer require symfony/symfony:^6.4.40

Technical details

A Cross-Site Scripting (XSS) vulnerability exists in the Symfony HtmlSanitizer component. The 'UrlAttributeSanitizer::getSupportedAttributes()' method fails to include several URL-valued attributes, specifically 'action', 'formaction', 'poster', and 'cite'. If a developer configures the sanitizer to allow these attributes, malicious 'javascript:' URIs will not be neutralized. An attacker can exploit this by providing a crafted URI that executes arbitrary JavaScript when a victim renders the HTML, submits a form, or clicks a button. The issue is resolved in versions 6.4.40, 7.4.12, and 8.0.12.

Affected products

  • Symfony symfony/symfony >= 6.1.0-BETA1, < 6.4.40
  • Symfony symfony/symfony >= 7.0.0-BETA1, < 7.4.12
  • Symfony symfony/symfony >= 8.0.0-BETA1, < 8.0.12
  • Symfony symfony/html-sanitizer >= 6.1.0-BETA1, < 6.4.40
  • Symfony symfony/html-sanitizer >= 7.0.0-BETA1, < 7.4.12
  • Symfony symfony/html-sanitizer >= 8.0.0-BETA1, < 8.0.12

Identifiers

  • CVE-2026-45753
  • GHSA-hhg7-c65m-h7ff

Timeline

  • 2026-05-20: patched: Versions 6.4.40, 7.4.12, and 8.0.12 released
  • 2026-07-14: advisory: Public advisory and CVE published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.