The vulnerability in Symfony’s HtmlSanitizer arises from the UrlAttributeSanitizer::getSupportedAttributes() method unintentionally excluding several URL‑valued attributes—action, formaction, poster, and cite—during sanitization. When applications running versions from 6.1.0‑BETA1 through 6.4.40, up to 7.4.12, and 8.0.12 let these attributes be used, javascript: URIs can pass through unfiltered. This allows an attacker to embed executable JavaScript that will run when the HTML is rendered, when a form is submitted, or when a user clicks a button, thereby enabling cross‑site scripting. The flaw is an input‑validation weakness and has been rated as CWE‑79 and CWE‑184. It is fixed in Symfony releases 6.4.40, 7.4.12, and 8.0.12.

Affected are the Symfony PHP framework and its HtmlSanitizer component in version ranges from 6.1.0‑BETA1 up to 6.4.40, as well as the released 7.4.12 and 8.0.12 releases. Users running any of these versions should verify their installed version and assess whether the vulnerable attribute handling is enabled in their application.

The CVSS score of 2.1 reflects a low severity, and the EPSS score of less than 1 % indicates a very low likelihood of active exploitation. The flaw is not listed in the CISA KEV catalog. The most plausible attack vector is the injection of malicious content through form submissions or content that is processed by the HtmlSanitizer, allowing an attacker to embed a javascript: URI in an allowed attribute that then executes in the victim's browser.