CVE-2026-45064: Symfony: HtmlSanitizer URL Attributes Pass Through BiDi Override Characters → Visual href Spoofing
Description
Symfony\Component\HtmlSanitizer\TextSanitizer\UrlSanitizer::parse() (used by UrlSanitizer::sanitize() and therefore by every HtmlSanitizer config that allows links or media) accepts URLs that contain Unicode explicit-direction BiDi formatting characters: U+202A–U+202E (LRE / RLE / PDF / LRO / RLO) and U+2066–U+2069 (LRI / RLI / FSI / PDI). These characters are passed through unchanged into the href / src attributes produced by HtmlSanitizer. When the resulting HTML is rendered in a browser, the override characters reverse or alter the visual ordering of the URL text, so the displayed link can differ arbitrarily from the actual destination: a classic visual-spoofing / phishing primitive against viewers of sanitized content.
Resolution
UrlSanitizer::parse() now rejects URLs containing the explicit-direction BiDi formatting code points (U+202A–U+202E, U+2066–U+2069) before invoking the underlying URL parser. As an unrelated companion fix in the same patch, spaces inside path/query/fragment are now percent-encoded rather than rejected outright, while spaces in the scheme/authority remain rejected by the post-encoding whitespace check.
The patch for this issue is available here for branch 5.4.
Credits
Symfony would like to thank Himanshu Anand for reporting the issue and Nicolas Grekas for providing the fix.
Other sources
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0-BETA1 until 6.4.40, 7.4.12, and 8.0.12, UrlSanitizer::parse() passes Unicode explicit-direction BiDi formatting characters through into sanitized href and src attributes, allowing sanitized content to display a link destination that visually differs from the actual destination and enabling phishing-style visual spoofing. This issue is fixed in versions 6.4.40, 7.4.12, and 8.0.12.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/symfony/symfonyto a version that resolves this vulnerability.Fixed in 8.0.12 - Upgrade
Upgrade
composer/symfony/symfonyto a version that resolves this vulnerability.Fixed in 7.4.12 - Upgrade
Upgrade
composer/symfony/symfonyto a version that resolves this vulnerability.Fixed in 6.4.40 - Upgrade
Upgrade
composer/symfony/html-sanitizerto a version that resolves this vulnerability.Fixed in 8.0.12 - Upgrade
Upgrade
composer/symfony/html-sanitizerto a version that resolves this vulnerability.Fixed in 7.4.12 - Upgrade
Upgrade
composer/symfony/html-sanitizerto a version that resolves this vulnerability.Fixed in 6.4.40 - Upgrade
Upgrade
Symfony HtmlSanitizer / UrlSanitizerto a version that resolves this vulnerability.Fixed in 6.4.40 - Upgrade
Upgrade
Symfony HtmlSanitizer / UrlSanitizerto a version that resolves this vulnerability.Fixed in 7.4.12 - Upgrade
Upgrade
Symfony HtmlSanitizer / UrlSanitizerto a version that resolves this vulnerability.Fixed in 8.0.12 - Compensating control
If you cannot upgrade immediately, prevent sanitized link/media output from being rendered with attacker-supplied URLs containing Unicode explicit-direction BiDi formatting code points U+202A–U+202E (LRE/RLE/PDF/LRO/RLO) and U+2066–U+2069 (LRI/RLI/FSI/PDI); reject or strip these characters before UrlSanitizer::sanitize() would parse the URL so that HtmlSanitizer cannot pass BiDi override characters through into href/src attributes.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45064?
The severity level of CVE-2026-45064 is rated at 37, indicating a moderate risk.
How do I fix CVE-2026-45064?
To mitigate CVE-2026-45064, update to the latest version of Symfony where the vulnerability has been patched.
What types of characters are exploited in CVE-2026-45064?
CVE-2026-45064 is exploited through Unicode explicit-direction BiDi formatting characters: U+202A to U+202E.
Which Symfony components are affected by CVE-2026-45064?
CVE-2026-45064 affects the Symfony component users of the HtmlSanitizer, particularly the UrlSanitizer class.
What impact does CVE-2026-45064 have on web applications?
CVE-2026-45064 can allow for potential injection attacks through improperly sanitized URLs in web applications.