AIKIDO-2026-533236

symfony/html-sanitizer is vulnerable to Incomplete List of Disallowed Inputs

CVE-2026-121949Published 4 days ago

CVE Score

Low

Incomplete List of Disallowed Inputs

TL;DR

Before the fix, UrlAttributeSanitizer did not list srcset or imagesrcset among its supported attributes, so DomVisitor kept an allowed attribute value verbatim when no sanitizer handled it. Anyone whose HTML the application sanitizes could keep responsive-image URL lists pointing at hosts or schemes barred by allowMediaHosts(), allowMediaSchemes() or forceHttpsUrls(), while the same policy dropped the matching src. This requires a configuration that permits these attributes, such as allowSafeElements(), allowStaticElements() or an explicit allowElement() or allowAttribute() call. The fix registers both attributes and checks each srcset candidate against the media scheme, host and HTTPS policy, dropping rejected candidates and the attribute when none survive.

How do I fix this?

Upgrade the symfony/html-sanitizer package to a fixed release on your branch: 6.4.50, 7.4.23, 8.1.11.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and sanitize HTML supplied by people you do not fully trust while allowing srcset or imagesrcset and relying on media host or scheme restrictions.