The UrlAttributeSanitizer component in Symfony omitted URL-bearing attributes on several HTML tags—<object>, <applet>, <iframe>, and <img>—and failed to sanitize URLs included in the content of <meta http-equiv='refresh'> elements. This oversight allows malicious URLs such as javascript:payload to be inserted into enabled elements or attributes and then rendered without sanitization, leading to cross‑site scripting vulnerabilities.

Versions of the Symfony Framework from 6.1.0 through 6.4.41, as well as the 7.4.13 and 8.0.13 releases of Symfony, and the symfony/html-sanitizer component in those same releases are affected. The issue was fixed in releases 6.4.41, 7.4.13, and 8.0.13 and any newer Symfony releases.

The CVSS score of 5.3 indicates a moderate severity. The EPSS score of less than 1% suggests that exploitation is unlikely to be widespread at this time. The vulnerability is not listed in the CISA KEV catalog. An attacker can embed malicious URLs in user‑supplied HTML content that bypasses sanitization, potentially executing unauthorized scripts in the victim’s browser.