Debian/symfony: unknown
The Symfony HtmlSanitizer component does not apply the media URL policy to the srcset and imagesrcset attributes, allowing values that point to hosts or schemes not permitted by allowMediaSchemes() or
Action: Upgrade symfony to 7.4.23+dfsg-1 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 7.4.23+dfsg-1 | - |
Fixed versions
| 7.4.23+dfsg-1 |
Sources
- osv: DEBIAN-CVE-2026-121949#Debian:14/symfony
- https://security-tracker.debian.org/tracker/CVE-2026-121949
published · modified · JSON