Packagist/symfony/html-sanitizer CVE-2026-45064: medium, EPSS 0.34%

Symfony's HtmlSanitizer URL Attributes Pass Through BiDi Override Characters → Visual href Spoofing

Action: Upgrade symfony/html-sanitizer to 6.4.40 or later.

composer require symfony/html-sanitizer:6.4.40

composer require symfony/html-sanitizer:7.4.12

composer require symfony/html-sanitizer:8.0.12

Affected

Fixed versions

Sources

• osv: GHSA-h5vq-qfcg-4m6p
• https://github.com/symfony/symfony/security/advisories/GHSA-h5vq-qfcg-4m6p
• https://github.com/symfony/symfony/commit/743a435e948b897ef2b5564ac438d4beb95d2526
• https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/html-sanitizer/CVE-2026-45064.yaml
• https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2026-45064.yaml
• https://github.com/symfony/symfony
• https://symfony.com/cve-2026-45064

CVE-2026-45064 · published 2026-05-27T20:04:22Z · modified 2026-09-10T03:51:05.868187206Z · JSON