Html-sanitizer

This hub aggregates every CVE we track for Html-sanitizer, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 10 most recently published vulnerabilities affecting Html-sanitizer.

• CVE-2026-48761Symfony: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes on <object>, <applet>, <iframe>, <img> and the URL Inside <meta http-equiv="refresh"> content6.1Jul 14, 2026
• CVE-2026-48760Symfony: HtmlSanitizer URL Parser Deny Gates Underinclusive: Percent-Encoded BiDi Marks and Unicode Whitespace Bypass Visual-Spoofing Defense6.1Jul 14, 2026
• CVE-2026-45064Symfony: HtmlSanitizer URL Attributes Pass Through BiDi Override Characters → Visual href Spoofing6.1Jul 14, 2026
• CVE-2026-45753Symfony: HtmlSanitizer UrlAttributeSanitizer Omits action/formaction/poster/cite — javascript: URI Survives Sanitization (XSS)6.1Jul 14, 2026
• CVE-2026-45066Symfony: HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URL-Parser Differentials and <area> Misclassification6.1Jul 14, 2026
• CVE-2024-34078html-sanitizer allows arbitrary HTML present after sanitization because of unicode normalization6.1May 6, 2024
• CVE-2023-47125By-passing Cross-Site Scripting Protection in HTML Sanitizer4.7Nov 14, 2023
• CVE-2023-38500By-passing Cross-Site Scripting Protection in HTML Sanitizer4.7Jul 25, 2023
• CVE-2022-23499Cross-Site Scripting Protection bypass in HTML Sanitizer6.1Dec 13, 2022
• CVE-2022-36020Bypass of Cross-Site Scripting Protection in typo3/html-sanitizer6.1Sep 13, 2022