CVE-2026-48761

MEDIUMPre-NVD 0.0
0.0
EchelonGraph verdictMonitorLow exploitation likelihood right now — keep watching.
  • No confirmed exploitation signals yet
CISA-KEV: Not listedEPSS: —CVSS: —Exploit: NoneExposed: 0

No vendor fix yet — apply a workaround or compensating control (WAF / firewall / segmentation) and watch for a patch.

Symfony: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes

Description

Symfony\Component\HtmlSanitizer\Visitor\AttributeSanitizer\UrlAttributeSanitizer::getSupportedAttributes() enumerates the attribute names whose values are scrubbed through UrlSanitizer::sanitize() (scheme and host allow-lists, javascript: rejection, BiDi check, etc.). The list is ['src', 'href', 'lowsrc', 'background', 'ping', 'action', 'formaction', 'poster', 'cite']. Other URL-bearing attributes are absent: `, , and , and . When an integrator opts these elements/attributes in via allowElement('object', ['data']), allowElement('applet', ['codebase']), etc., or via allowAttribute(), no URL sanitization runs: data="javascript:alert(1)" and similar payloads ship through unchanged into the output, enabling stored XSS.

is the same class of bug routed differently: the URL is embedded inside a multi-field content attribute that the per-attribute sanitizer cannot detect from the attribute name alone. Integrators who enable with the content attribute (e.g. via allowStaticElements()) see content="0; url=javascript:alert(1)" pass through, producing a refresh-driven navigation to a javascript: URL.

Default configurations are not affected: , and are not in W3CReference::BODY_ELEMENTS and requires an explicit opt-in to context. The vulnerability surface is integrators who explicitly allow any of those elements together with the listed URL-bearing attributes.

Resolution

UrlAttributeSanitizer now also routes data, codebase, archive and longdesc through UrlSanitizer::sanitize(). A new MetaRefreshAttributeSanitizer registered as a default attribute sanitizer detects the ; url= syntax inside , sanitizes the embedded URL, and drops the attribute if the URL is rejected; non-refresh meta content` values are passed through unchanged.

The patches for this issue are available here for branch 6.4 (and forward-ported to 7.4, 8.0 and 8.1).

Credits

Symfony would like to thank Scott Arciszewski (Trail of Bits) for reporting the issue and Nicolas Grekas for providing the fix.

CVSS v3
—
EG Score
0.0(none)
EPSS
—
KEV
Not listed

Published

June 15, 2026

Last Modified

June 15, 2026

Vendor Advisories for CVE-2026-48761(1)

These vendors published their own advisory mentioning this CVE — often with vendor-specific remediation steps + affected product lists not in NVD.

Affected Packages

(2 across 1 ecosystem)
Packagist(2)
PackageVulnerable rangeFixed inDependents
symfony/html-sanitizerv8.0.0, v8.0.12, v8.0.7, v8.0.88.0.13—
symfony/symfonyv8.0.0 ... v8.0.9 (13 versions)8.0.13—

Data Freshness Timeline

(refreshed 0× in last 7d / 1× in last 30d)

Each row is a source pipeline that fetched or updated this CVE on that date, with what changed. For example, "NVD update" means NVD published or revised its analysis for this CVE; "MITRE cvelistV5" means we ingested or refreshed it from the CNA feed. Most recent first.

  1. 2026-06-15 17:16 UTCEG score recompute

Frequently asked(3)

What is CVE-2026-48761?
CVE-2026-48761 is a medium vulnerability published on June 15, 2026. Symfony: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes Description Symfony\Component\HtmlSanitizer\Visitor\AttributeSanitizer\UrlAttributeSanitizer::getSupportedAttributes() enumerates the attribute names whose values are scrubbed through UrlSanitizer::sanitize() (scheme and host…
When was CVE-2026-48761 disclosed?
CVE-2026-48761 was first published in the National Vulnerability Database on June 15, 2026. EchelonGraph re-ingests CVE updates from NVD on a 2-hour cycle, so this page reflects the latest published state.
How do I remediate CVE-2026-48761?
Patch to the fixed version published by the affected vendor. Where vendor advisories exist for CVE-2026-48761, EchelonGraph cross-links them in the Vendor Advisories panel below — those typically contain the canonical remediation steps, fixed version numbers, and any vendor-specific mitigations.

Dependency Blast Radius

See which npm, PyPI, Go, and Maven packages are affected by CVE-2026-48761

Explore →

Is Your Infrastructure Affected by CVE-2026-48761?

EchelonGraph automatically scans your cloud infrastructure and maps CVE exposure using blast radius analysis.

Start Free Scan →Browse All CVEs