Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| symfony/html-sanitizer | composer | >= 6.1.0, < 6.4.41 | 6.4.41 |
| symfony/html-sanitizer | composer | >= 7.0.0, < 7.4.13 | 7.4.13 |
| symfony/html-sanitizer | composer | >= 8.0.0, < 8.0.13 | 8.0.13 |
| symfony/symfony | composer | >= 6.1.0, < 6.4.41 | 6.4.41 |
| symfony/symfony | composer | >= 7.0.0, < 7.4.13 | 7.4.13 |
| symfony/symfony | composer | >= 8.0.0, < 8.0.13 | 8.0.13 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from incomplete URL sanitization within the Symfony HtmlSanitizer component, leading to two distinct cross-site scripting (XSS) vectors. An analysis of the provided patch commit reveals the exact nature of these flaws.
First, the UrlAttributeSanitizer was not configured to sanitize all attributes that can contain URLs. The getSupportedAttributes function in UrlAttributeSanitizer.php was missing several URL-bearing attributes, including data, codebase, archive, and longdesc. This meant that if a developer configured the sanitizer to allow elements like <object> or <applet> with these attributes, any URL provided in them, including malicious javascript: payloads, would not be sanitized.
Second, the sanitizer lacked the capability to handle URLs embedded within the content attribute of <meta http-equiv="refresh"> tags. The default configuration, set in HtmlSanitizerConfig::__construct, did not include a sanitizer to parse this specific format. This allowed an attacker to craft a payload like content="0; url=javascript:alert(1)" which would be executed by the browser if the application allowed <meta> tags.
The patch addresses these issues by:
UrlAttributeSanitizer::getSupportedAttributes to include the missing ones.MetaRefreshAttributeSanitizer class to specifically handle and sanitize URLs within the content attribute of meta-refresh tags and registering it in the HtmlSanitizerConfig constructor.Symfony\Component\HtmlSanitizer\Visitor\AttributeSanitizer\UrlAttributeSanitizer::getSupportedAttributessrc/Symfony/Component/HtmlSanitizer/Visitor/AttributeSanitizer/UrlAttributeSanitizer.php
Symfony\Component\HtmlSanitizer\HtmlSanitizerConfig::__constructsrc/Symfony/Component/HtmlSanitizer/HtmlSanitizerConfig.php