Security

CVE-2026-45753, Symfony HtmlSanitizer

Symfony's HtmlSanitizer strips dangerous markup from untrusted HTML. One class, UrlAttributeSanitizer, checks the scheme of every URL attribute. Its list of attributes held src, href, lowsrc, background and ping. It left out action, formaction, poster and cite, so a javascript: URI in one of those four went through untouched and could run as XSS.

The default allowSafeElements() configuration is not affected. The bug needs a configuration that allows one of those attributes on purpose, such as a form with its action.

Affected

symfony/html-sanitizer from 6.1.0, before 6.4.40, 7.4.12 and 8.0.12

Fixed in

6.4.40, 7.4.12, 8.0.12

Class

CWE-79, cross-site scripting. Severity: low

Published

28 May 2026

Advisory

GHSA-hhg7-c65m-h7ff

I reported it and the Symfony team fixed it.

Tailscale, in triage

I sent reports to the Tailscale security team in 2026. One finding was new to them and is being fixed, with credit in the fix. Another matched an issue they had already fixed. The details stay private until the fix ships, and this page will carry the write-up then.

Research in public

The analyses and tools I publish, on PHP, Samsung Galaxy and Google Home Mini, are listed on the home page.