Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-121373— Symfony: HtmlSanitizer MetaRefreshAttributeSanitizer Matches Only a Narrow Subset of the Browser Refresh Grammar (Incomplete Fix for CVE-2026-48761)

Quick assessment

Affected
sensiolabs symfony
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Symfony HtmlSanitizer 组件中的 （旨在修复 CVE-2026-48761）使用正则表达式对 标签 属性中的刷新 URL 进行清理，但该正则表达式过于狭隘，导致清理机制可被绕过。在 Symfony 6.1.x（6.4.50 之前）、7.x（7.4.23 之前）以及 8.x（8.1.11 之前）版本中，这可能导致用户被重定向到不受信任的网站。 根据 WHATWG HTML 标准中关于声明式刷新步骤的规范，需要采用更广泛的解析方法：时间值之后的分隔符可以仅为 ASCII 空白字符（无需 或 ），且

CVSS 5.3 · Medium

Affected Version Matrix 3

VendorProduct Version RangeStatus
sensiolabs symfony 6.1.0< 6.4.50 affected
7.0.0< 7.4.23 affected
8.0.0< 8.1.11 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-121373

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Symfony: HtmlSanitizer MetaRefreshAttributeSanitizer Matches Only a Narrow Subset of the Browser Refresh Grammar (Incomplete Fix for CVE-2026-48761)
Source: CVE Program / CVE List V5
Vulnerability Description
The Symfony HtmlSanitizer component MetaRefreshAttributeSanitizer, introduced to fix CVE-2026-48761, sanitizes the refresh URL of content attributes of meta tags using a regular expression that is too narrow, allowing sanitization to be bypassed, and resulting in potential URL redirection to untrusted sites in Symfony versions 6.1.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11. The shared declarative refresh steps in the WHATWG HTML Standard require a broader approach: the separator after the time may be ASCII whitespace alone, with no ; or ,, and the url= keyword is optional. Directives the browser honours, but the regular expression misses are returned unchanged, so the attacker URL skips UrlSanitizer entirely and both allowLinkSchemes and allowLinkHosts are defeated for the refresh navigation. This is reachable under any configuration that allows meta with http-equiv and content, including the documented allowStaticElements() preset.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
过度严格的正则表达式
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
sensiolabs symfony 6.1.0 ~ 6.4.50 -

II. Public POCs for CVE-2026-121373

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-121373

请登录查看更多情报信息。

Other References for CVE-2026-121373 (2)

Same Patch Batch · sensiolabs · 2026-11-04 · 4 CVEs total

CVE-2026-121971 8.2 HIGH Symfony: ScopingHttpClient Sends the Credentials of Its Default Scope to Other Origins Thr
CVE-2026-118513 7.7 HIGH Symfony: X.509 Authentication Impersonation via DN Value Injection (incomplete fix for CVE
CVE-2026-118516 6.3 MEDIUM Symfony: Host Placeholders Can Match the Start of the Path in Compiled URL Matchers, Bypas

IV. Related Vulnerabilities

Same product: symfony
Same vendor: sensiolabs
Same weakness: CWE-186