CVE-2026-45753: Sensiolabs Symfony XSS Vulnerability

CVE-2026-45753 Overview

CVE-2026-45753 is a Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Symfony PHP framework's HtmlSanitizer component. The UrlAttributeSanitizer::getSupportedAttributes() method omits several URL-valued HTML attributes, including action, formaction, poster, and cite. When a sanitizer configuration permits these attributes, javascript: URIs pass through unsanitized. An attacker can inject scripts that execute when the rendered HTML loads, when a victim submits a form, or when a user clicks a button. The issue affects Symfony versions from 6.1.0-BETA1 through 6.4.39, 7.4.11, and 8.0.11, and is fixed in 6.4.40, 7.4.12, and 8.0.12.

Critical Impact
Attackers can execute arbitrary JavaScript in a victim's browser session when sanitized HTML output includes attacker-controlled action, formaction, poster, or cite attributes.

Affected Products

Symfony 6.1.0-BETA1 through 6.4.39
Symfony 7.0.0 through 7.4.11
Symfony 8.0.0 through 8.0.11

Discovery Timeline

2026-07-14 - CVE-2026-45753 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-45753

Vulnerability Analysis

The Symfony HtmlSanitizer component filters untrusted HTML to prevent XSS. Its UrlAttributeSanitizer class is responsible for sanitizing attributes that contain URLs, applying the configured allowed link schemes list. The class advertises which attributes it can sanitize through getSupportedAttributes(). That method returned only src, href, lowsrc, background, and ping, missing the equally URL-valued attributes action, formaction, poster, and cite.

When a user-defined HtmlSanitizerConfig allows any of these missing attributes on elements such as <form>, <button>, <video>, <q>, or <blockquote>, the sanitizer treats their values as opaque strings. Values such as javascript:alert(1) survive sanitization and reach the rendered DOM, breaking the trust boundary the component is designed to enforce.

Root Cause

The root cause is an incomplete attribute allow-list in src/Symfony/Component/HtmlSanitizer/Visitor/AttributeSanitizer/UrlAttributeSanitizer.php. The list of URL-bearing attributes did not track HTML specification coverage. The sanitizeAttribute() routine also gated URL sanitization on element name (a, area) rather than attribute semantics, so form and media elements bypassed scheme validation.

Attack Vector

Exploitation requires a Symfony application that uses HtmlSanitizer with a configuration that permits the affected attributes on relevant elements. An attacker submits crafted HTML through any input the application later sanitizes and renders. Victim interaction, such as loading the page, submitting a form, or clicking a button, triggers the javascript: payload in the victim's session context.

php

     public function getSupportedAttributes(): ?array
     {
-        return ['src', 'href', 'lowsrc', 'background', 'ping'];
+        return ['src', 'href', 'lowsrc', 'background', 'ping', 'action', 'formaction', 'poster', 'cite'];
     }

     public function sanitizeAttribute(string $element, string $attribute, string $value, HtmlSanitizerConfig $config): ?string
     {
-        if (\in_array($element, ['a', 'area'], true)) {
+        if (\in_array($element, ['a', 'area'], true) || \in_array($attribute, ['action', 'formaction', 'cite'], true)) {
             return UrlSanitizer::sanitize(
                 $value,
                 $config->getAllowedLinkSchemes(),

Source: Symfony patch commit 487728e. The patch extends both the supported attribute list and the element-or-attribute check so URL scheme validation applies to action, formaction, and cite regardless of the parent element.

Detection Methods for CVE-2026-45753

Indicators of Compromise

HTML content stored or rendered by the application containing action, formaction, poster, or cite attribute values beginning with javascript:, data:, or other unexpected schemes.
Web server or application logs showing user submissions with form fragments such as <form action="javascript:..."> or <button formaction="javascript:...">.
Browser Content Security Policy (CSP) violation reports referencing inline script execution on pages rendering sanitized user HTML.

Detection Strategies

Audit the application's HtmlSanitizerConfig to identify configurations that call allowAttribute('action', ...), allowAttribute('formaction', ...), allowAttribute('poster', ...), or allowAttribute('cite', ...).
Grep stored user content and database columns holding rendered HTML for the affected attribute names combined with javascript: URIs.
Add regression tests that pass known-bad payloads through the sanitizer and assert the resulting attribute values are stripped or normalized.

Monitoring Recommendations

Enable and monitor CSP reporting for script-src violations originating from pages that render user-supplied HTML.
Track the installed Symfony version across environments and alert on hosts still running vulnerable releases prior to 6.4.40, 7.4.12, or 8.0.12.
Log calls into UrlAttributeSanitizer in staging environments to surface unexpected attribute names appearing in inbound HTML.

How to Mitigate CVE-2026-45753

Immediate Actions Required

Upgrade Symfony to 6.4.40, 7.4.12, or 8.0.12 depending on the branch in use.
Review every HtmlSanitizerConfig in the codebase and remove permissions for action, formaction, poster, and cite unless strictly required.
Re-sanitize or purge stored HTML content that was accepted while the vulnerable configuration was active.

Patch Information

The fix is committed in Symfony commit 487728e and shipped in Symfony v6.4.40, Symfony v7.4.12, and Symfony v8.0.12. Full technical detail is documented in the GitHub Security Advisory GHSA-hhg7-c65m-h7ff.

Workarounds

Restrict allowed link schemes in HtmlSanitizerConfig to http and https using allowLinkSchemes(['http', 'https']) so javascript: URIs are rejected globally.
Disallow the affected attributes (action, formaction, poster, cite) on every element in the sanitizer configuration until the framework upgrade is applied.
Deploy a strict Content Security Policy that blocks inline script execution and javascript: URIs as a defense-in-depth control.

bash

# Upgrade Symfony via Composer to a patched release
composer require symfony/html-sanitizer:^6.4.40
# or for the 7.4 branch
composer require symfony/html-sanitizer:^7.4.12
# or for the 8.0 branch
composer require symfony/html-sanitizer:^8.0.12