CVE-2026-121373

Name of the Vulnerable Software and Affected Versions Symfony versions 6.1.x through 6.4.49 Symfony versions 7.x through 7.4.22 Symfony versions 8.x through 8.1.10

Description The MetaRefreshAttributeSanitizer within the Symfony HtmlSanitizer component uses an overly narrow regular expression to sanitize the refresh URL of content attributes in meta tags. This allows the sanitization process to be bypassed, potentially leading to URL redirection to untrusted sites. The issue occurs because the regular expression fails to account for the WHATWG HTML Standard, where the separator after the time can be ASCII whitespace without a semicolon or comma, and the url= keyword is optional. Consequently, certain directives recognized by browsers are returned unchanged, bypassing the UrlSanitizer and defeating the allowLinkSchemes and allowLinkHosts restrictions. This is reachable in configurations that allow meta tags with http-equiv and content, such as the allowStaticElements() preset.

Recommendations Update to version 6.4.50 or later for the 6.1.x branch. Update to version 7.4.23 or later for the 7.x branch. Update to version 8.1.11 or later for the 8.x branch.