GHSA-X5QJ-865H-MGVM中危已审查

Symfony: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes

OSV 1.4.0 · github-reviewed · 修改于 2026-06-16 00:46

发布时间

2026-06-16 00:46

GitHub 审查时间

2026-06-16 00:46

NVD 发布时间

—

源文件

advisories/github-reviewed/2026/06/GHSA-x5qj-865h-mgvm/GHSA-x5qj-865h-mgvm.json

公告说明

Description

Symfony\Component\HtmlSanitizer\Visitor\AttributeSanitizer\UrlAttributeSanitizer::getSupportedAttributes() enumerates the attribute names whose values are scrubbed through UrlSanitizer::sanitize() (scheme and host allow-lists, javascript: rejection, BiDi check, etc.). The list is ['src', 'href', 'lowsrc', 'background', 'ping', 'action', 'formaction', 'poster', 'cite']. Other URL-bearing attributes are absent: <object data=…>, <applet codebase=…>, <applet archive=…> and <object archive=…>, <iframe longdesc=…> and <img longdesc=…>. When an integrator opts these elements/attributes in via allowElement('object', ['data']), allowElement('applet', ['codebase']), etc., or via allowAttribute(), no URL sanitization runs: data="javascript:alert(1)" and similar payloads ship through unchanged into the output, enabling stored XSS.

<meta http-equiv="refresh" content="0; url=…"> is the same class of bug routed differently: the URL is embedded inside a multi-field content attribute that the per-attribute sanitizer cannot detect from the attribute name alone. Integrators who enable <meta> with the content attribute (e.g. via allowStaticElements()) see content="0; url=javascript:alert(1)" pass through, producing a refresh-driven navigation to a javascript: URL.

Default configurations are not affected: <object>, <applet> and <iframe> are not in W3CReference::BODY_ELEMENTS and <meta> requires an explicit opt-in to <head> context. The vulnerability surface is integrators who explicitly allow any of those elements together with the listed URL-bearing attributes.

Resolution

UrlAttributeSanitizer now also routes data, codebase, archive and longdesc through UrlSanitizer::sanitize(). A new registered as a default attribute sanitizer detects the syntax inside , sanitizes the embedded URL, and drops the attribute if the URL is rejected; non-refresh meta values are passed through unchanged.

标识信息

别名 / CVE

CVE-2026-48761

CWE

CWE-1023CWE-79

软件生态

Packagist

扩展资料

暂无扩展资料。

CVSS 评分

CVSS_V4

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

原始 OSV JSON

{
  "id": "GHSA-x5qj-865h-mgvm",
  "aliases": [
    "CVE-2026-48761"
  ],
  "details": "### Description\n\n`Symfony\\Component\\HtmlSanitizer\\Visitor\\AttributeSanitizer\\UrlAttributeSanitizer::getSupportedAttributes()` enumerates the attribute names whose values are scrubbed through `UrlSanitizer::sanitize()` (scheme and host allow-lists, `javascript:` rejection, BiDi check, etc.). The list is `['src', 'href', 'lowsrc', 'background', 'ping', 'action', 'formaction', 'poster', 'cite']`. Other URL-bearing attributes are absent: `<object data=…>`, `<applet codebase=…>`, `<applet archive=…>` and `<object archive=…>`, `<iframe longdesc=…>` and `<img longdesc=…>`. When an integrator opts these elements/attributes in via `allowElement('object', ['data'])`, `allowElement('applet', ['codebase'])`, etc., or via `allowAttribute()`, no URL sanitization runs: `data=\"javascript:alert(1)\"` and similar payloads ship through unchanged into the output, enabling stored XSS.\n\n`<meta http-equiv=\"refresh\" content=\"0; url=…\">` is the same class of bug routed differently: the URL is embedded inside a multi-field `content` attribute that the per-attribute sanitizer cannot detect from the attribute name alone. Integrators who enable `<meta>` with the `content` attribute (e.g. via `allowStaticElements()`) see `content=\"0; url=javascript:alert(1)\"` pass through, producing a refresh-driven navigation to a `javascript:` URL.\n\nDefault configurations are not affected: `<object>`, `<applet>` and `<iframe>` are not in `W3CReference::BODY_ELEMENTS` and `<meta>` requires an explicit opt-in to `<head>` context. The vulnerability surface is integrators who explicitly allow any of those elements together with the listed URL-bearing attributes.\n\n### Resolution\n\n`UrlAttributeSanitizer` now also routes `data`, `codebase`, `archive` and `longdesc` through `UrlSanitizer::sanitize()`. A new `MetaRefreshAttributeSanitizer` registered as a default attribute sanitizer detects the `<delay>; url=<url>` syntax inside `<meta content>`, sanitizes the embedded URL, and drops the attribute if the URL is rejected; non-refresh meta `content` values are passed through unchanged.\n\nThe patches for this issue are available [here](https://github.com/symfony/symfony/commit/069a70f9f26e61e9de3b7f9a864a86ed24b36bd0) for branch 6.4 (and forward-ported to 7.4, 8.0 and 8.1).\n\n### Credits\n\nSymfony would like to thank Scott Arciszewski (Trail of Bits) for reporting the issue and Nicolas Grekas for providing the fix.",
  "summary": "Symfony: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes",
  "affected": [
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "6.1.0"
            },
            {
              "fixed": "6.4.41"
            }
          ]
        }
      ],
      "package": {
        "name": "symfony/html-sanitizer",
        "ecosystem": "Packagist"
      }
    },
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "7.0.0"
            },
            {
              "fixed": "7.4.13"
            }
          ]
        }
      ],
      "package": {
        "name": "symfony/html-sanitizer",
        "ecosystem": "Packagist"
      }
    },
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.13"
            }
          ]
        }
      ],
      "package": {
        "name": "symfony/html-sanitizer",
        "ecosystem": "Packagist"
      }
    },
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "6.1.0"
            },
            {
              "fixed": "6.4.41"
            }
          ]
        }
      ],
      "package": {
        "name": "symfony/symfony",
        "ecosystem": "Packagist"
      }
    },
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "7.0.0"
            },
            {
              "fixed": "7.4.13"
            }
          ]
        }
      ],
      "package": {
        "name": "symfony/symfony",
        "ecosystem": "Packagist"
      }
    },
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.13"
            }
          ]
        }
      ],
      "package": {
        "name": "symfony/symfony",
        "ecosystem": "Packagist"
      }
    }
  ],
  "modified": "2026-06-15T16:46:53Z",
  "severity": [
    {
      "type": "CVSS_V4",
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"
    }
  ],
  "published": "2026-06-15T16:46:53Z",
  "references": [
    {
      "url": "https://github.com/symfony/symfony/security/advisories/GHSA-x5qj-865h-mgvm",
      "type": "WEB"
    },
    {
      "url": "https://github.com/symfony/symfony/commit/069a70f9f26e61e9de3b7f9a864a86ed24b36bd0",
      "type": "WEB"
    },
    {
      "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/html-sanitizer/CVE-2026-48761.yaml",
      "type": "WEB"
    },
    {
      "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2026-48761.yaml",
      "type": "WEB"
    },
    {
      "url": "https://github.com/symfony/symfony",
      "type": "PACKAGE"
    },
    {
      "url": "https://symfony.com/cve-2026-48761",
      "type": "WEB"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [
      "CWE-1023",
      "CWE-79"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "nvd_published_at": null,
    "github_reviewed_at": "2026-06-15T16:46:53Z"
  }
}