UrlSanitizer::parse() in Symfony's HtmlSanitizer component passes Unicode explicit‑direction BiDi formatting characters into sanitized href and src attributes, letting sanitized content display a link destination that visually differs from its actual destination. This creates phishing‑style visual spoofing for releases from 6.1.0‑BETA1 through 6.4.40, 7.4.12, and 8.0.12. The issue is fixed in versions 6.4.40, 7.4.12, and 8.0.12. The weakness is represented by CWE‑1007 and CWE‑451.

The flaw affects the Symfony framework and its HtmlSanitizer component in versions from 6.1.0‑BETA1 through 6.4.40, from 7.4.12, and from 8.0.12. Users running any of these releases without applying the patch are susceptible, while later releases (6.4.40 or newer, 7.4.12 or newer, 8.0.12 or newer) contain the fix.

With a CVSS score of 2.3 and an EPSS score of less than 1%, the likelihood of exploitation is low and it is not listed in the CISA KEV catalog. Exploitation requires an attacker to supply crafted HTML that includes invisible BiDi characters in URL attributes, typically achieved via injection or template abuse. Successful exploitation leads to deceptive user clicks and potential credential theft rather than code execution or system compromise.