HT
Product
html-sanitizer
5
CVEs
0
On KEV
6.1
Max CVSS
0
New 30D
Severity mix
Critical 0High 0Medium 5Low 0
Watch
Add html-sanitizer to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-48761 | 6.1 | Jul 14 | Symfony: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes on <object>, <applet>, <iframe>, <img> and the URL Inside <meta http-equiv="refresh"> content Affected: >= 6.1.0, < 6.4.41; >= 7.0.0-BETA1, < 7.4.13; >= 8.0.0-BETA1, < 8.0.13 |
| CVE-2026-48760 | 6.1 | Jul 14 | Symfony: HtmlSanitizer URL Parser Deny Gates Underinclusive: Percent-Encoded BiDi Marks and Unicode Whitespace Bypass Visual-Spoofing Defense Affected: >= 6.1.0, < 6.4.41; >= 7.0.0-BETA1, < 7.4.13; >= 8.0.0-BETA1, < 8.0.13 |
| CVE-2026-45064 | 6.1 | Jul 14 | Symfony: HtmlSanitizer URL Attributes Pass Through BiDi Override Characters → Visual href Spoofing Affected: >= 6.1.0-BETA1, < 6.4.40; >= 7.0.0-BETA1, < 7.4.12; >= 8.0.0-BETA1, < 8.0.12 |
| CVE-2026-45753 | 6.1 | Jul 14 | Symfony: HtmlSanitizer UrlAttributeSanitizer Omits action/formaction/poster/cite — javascript: URI Survives Sanitization (XSS) Affected: >= 6.1.0-BETA1, < 6.4.40; >= 7.0.0-BETA1, < 7.4.12; >= 8.0.0-BETA1, < 8.0.12 |
| CVE-2026-45066 | 6.1 | Jul 14 | Symfony: HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URL-Parser Differentials and <area> Misclassification Affected: >= 6.1.0-BETA1, < 6.4.40; >= 7.0.0-BETA1, < 7.4.12; >= 8.0.0-BETA1, < 8.0.12 |
Showing 5