GHSA-x5qj-865h-mgvm — symfony/html-sanitizer
Fix: symfony/symfony@069a70fGHSA-x5qj-865h-mgvm is a Cross-site Scripting (XSS) vulnerability in symfony/html-sanitizer. A fix is available for symfony/html-sanitizer — see the affected versions and patch details below.
Symfony: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes
Exploitation Status
No confirmed exploitation observed yet
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for GHSA-x5qj-865h-mgvm.
EPSS Exploitation Probability
EPSS (Exploit Prediction Scoring System) is a daily probability model maintained by FIRST.org. It estimates the likelihood a CVE will be exploited in production environments within the next 30 days, derived from real-world threat intelligence signals.
Real-World Exposure
symfony/html-sanitizer🐘symfony/html-sanitizer🐘symfony/html-sanitizer🐘symfony/symfony🐘symfony/symfony🐘symfony/symfonyReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.
Description
Description
Symfony\Component\HtmlSanitizer\Visitor\AttributeSanitizer\UrlAttributeSanitizer::getSupportedAttributes() enumerates the attribute names whose values are scrubbed through UrlSanitizer::sanitize() (scheme and host allow-lists, javascript: rejection, BiDi check, etc.). The list is ['src', 'href', 'lowsrc', 'background', 'ping', 'action', 'formaction', 'poster', 'cite']. Other URL-bearing attributes are absent: <object data=…>, <applet codebase=…>, <applet archive=…> and <object archive=…>, <iframe longdesc=…> and <img longdesc=…>. When an integrator opts these elements/attributes in via allowElement('object', ['data']), allowElement('applet', ['codebase']), etc., or via allowAttribute(), no URL sanitization runs: data="javascript:alert(1)" and similar payloads ship through unchanged into the output, enabling stored XSS.
<meta http-equiv="refresh" content="0; url=…"> is the same class of bug routed differently: the URL is embedded inside a multi-field content attribute that the per-attribute sanitizer cannot detect from the attribute name alone. Integrators who enable <meta> with the content attribute (e.g. via allowStaticElements()) see content="0; url=javascript:alert(1)" pass through, producing a refresh-driven navigation to a javascript: URL.
Default configurations are not affected: <object>, <applet> and <iframe> are not in W3CReference::BODY_ELEMENTS and <meta> requires an explicit opt-in to <head> context. The vulnerability surface is integrators who explicitly allow any of those elements together with the listed URL-bearing attributes.
Resolution
UrlAttributeSanitizer now also routes data, codebase, archive and longdesc through UrlSanitizer::sanitize(). A new MetaRefreshAttributeSanitizer registered as a default attribute sanitizer detects the <delay>; url=<url> syntax inside <meta content>, sanitizes the embedded URL, and drops the attribute if the URL is rejected; non-refresh meta content values are passed through unchanged.
The patches for this issue are available here for branch 6.4 (and forward-ported to 7.4, 8.0 and 8.1).
Credits
Symfony would like to thank Scott Arciszewski (Trail of Bits) for reporting the issue and Nicolas Grekas for providing the fix.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐘Packagist | symfony/html-sanitizer | ≥ 6.1.0&&< 6.4.41 | 6.4.41composer require symfony/html-sanitizer:^6.4.41 |
| 🐘Packagist | symfony/html-sanitizer | ≥ 7.0.0&&< 7.4.13 | 7.4.13composer require symfony/html-sanitizer:^7.4.13 |
| 🐘Packagist | symfony/html-sanitizer | ≥ 8.0.0&&< 8.0.13 | 8.0.13composer require symfony/html-sanitizer:^8.0.13 |
| 🐘Packagist | symfony/symfony | ≥ 6.1.0&&< 6.4.41 | 6.4.41composer require symfony/symfony:^6.4.41 |
| 🐘Packagist | symfony/symfony | ≥ 7.0.0&&< 7.4.13 | 7.4.13composer require symfony/symfony:^7.4.13 |
| 🐘Packagist | symfony/symfony | ≥ 8.0.0&&< 8.0.13 | 8.0.13composer require symfony/symfony:^8.0.13 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for symfony/html-sanitizer, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update symfony/html-sanitizer to 6.4.41 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-x5qj-865h-mgvm is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 Security's impact-aware SCA analyses which vulnerable code paths your application actually calls, so a match like GHSA-x5qj-865h-mgvm can be triaged on real exposure rather than presence alone.
Tailored to GHSA-x5qj-865h-mgvm. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is GHSA-x5qj-865h-mgvm in your dependencies?
O3 Security finds GHSA-x5qj-865h-mgvm across Packagist dependencies, including transitive ones, and its impact-aware SCA ranks findings by whether your code actually calls the vulnerable path.