Nixpkgs security tracker

Untriaged

Permalink CVE-2026-45064

2.3 LOW

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): Present (P)
Privileges Required (PR): None (N)
User Interaction (UI): Passive (P)
Vulnerable System Impact Confidentiality (VC): None (N)
Vulnerable System Impact Integrity (VI): None (N)
Vulnerable System Impact Availability (VA): None (N)
Subsequent System Impact Confidentiality (SC): Low (L)
Subsequent System Impact Integrity (SI): Low (L)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): Present (P)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Passive (P)
Modified Vulnerable System Impact Confidentiality (MVC): None (N)
Modified Vulnerable System Impact Integrity (MVI): None (N)
Modified Vulnerable System Impact Availability (MVA): None (N)
Modified Subsequent System Impact Confidentiality (MSC): Low (L)
Modified Subsequent System Impact Integrity (MSI): Low (L)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

created 1 day, 16 hours ago Activity log

Created suggestion 1 day, 16 hours ago

Symfony: HtmlSanitizer URL Attributes Pass Through BiDi Override Characters → Visual href Spoofing

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0-BETA1 until 6.4.40, 7.4.12, and 8.0.12, UrlSanitizer::parse() passes Unicode explicit-direction BiDi formatting characters through into sanitized href and src attributes, allowing sanitized content to display a link destination that visually differs from the actual destination and enabling phishing-style visual spoofing. This issue is fixed in versions 6.4.40, 7.4.12, and 8.0.12.

References

https://github.com/symfony/symfony/security/advisories/GHSA-h5vq-qfcg-4m6p x_refsource_CONFIRM
https://github.com/symfony/symfony/commit/743a435e948b897ef2b5564ac438d4beb95d2526 x_refsource_MISC
https://github.com/symfony/symfony/releases/tag/v6.4.40 x_refsource_MISC
https://github.com/symfony/symfony/releases/tag/v7.4.12 x_refsource_MISC
https://github.com/symfony/symfony/releases/tag/v8.0.12 x_refsource_MISC

Affected products

symfony

==>= 6.1.0-BETA1, < 6.4.40
==>= 7.0.0-BETA1, < 7.4.12
==>= 8.0.0-BETA1, < 8.0.12

html-sanitizer

==>= 6.1.0-BETA1, < 6.4.40
==>= 7.0.0-BETA1, < 7.4.12
==>= 8.0.0-BETA1, < 8.0.12

Matching in nixpkgs

pkgs.symfony-cli

Symfony CLI

nixos-unstable 5.17.1
- nixpkgs-unstable 5.17.1
- nixos-unstable-small 5.17.1
nixos-26.05 5.17.1
- nixos-26.05-small 5.17.1
- nixpkgs-26.05-darwin 5.17.1

pkgs.python313Packages.html-sanitizer

Allowlist-based and very opinionated HTML sanitizer

nixos-unstable 2.6
- nixpkgs-unstable 2.6
- nixos-unstable-small 2.6
nixos-26.05 2.6
- nixos-26.05-small 2.6
- nixpkgs-26.05-darwin 2.6

pkgs.python314Packages.html-sanitizer

Allowlist-based and very opinionated HTML sanitizer

nixos-unstable 2.6
- nixpkgs-unstable 2.6
- nixos-unstable-small 2.6
nixos-26.05 2.6
- nixos-26.05-small 2.6
- nixpkgs-26.05-darwin 2.6

pkgs.rubyPackages.rails-html-sanitizer

None

nixos-unstable 1.6.2
- nixpkgs-unstable 1.6.2
- nixos-unstable-small 1.6.2
nixos-26.05 1.6.2
- nixos-26.05-small 1.6.2
- nixpkgs-26.05-darwin 1.6.2

pkgs.rubyPackages_3_3.rails-html-sanitizer

None

nixos-unstable 1.6.2
- nixpkgs-unstable 1.6.2
- nixos-unstable-small 1.6.2
nixos-26.05 1.6.2
- nixos-26.05-small 1.6.2
- nixpkgs-26.05-darwin 1.6.2

pkgs.rubyPackages_3_4.rails-html-sanitizer

None

nixos-unstable 1.6.2
- nixpkgs-unstable 1.6.2
- nixos-unstable-small 1.6.2
nixos-26.05 1.6.2
- nixos-26.05-small 1.6.2
- nixpkgs-26.05-darwin 1.6.2

pkgs.rubyPackages_4_0.rails-html-sanitizer

None

nixos-unstable 1.6.2
- nixpkgs-unstable 1.6.2
- nixos-unstable-small 1.6.2
nixos-26.05 1.6.2
- nixos-26.05-small 1.6.2
- nixpkgs-26.05-darwin 1.6.2

Package maintainers

@fabaff Fabian Affolter <mail@fabian-affolter.ch>
@patka-123 patka <patka@patka.dev>

Untriaged

Permalink CVE-2026-45753

2.1 LOW

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): Present (P)
Privileges Required (PR): None (N)
User Interaction (UI): Active (A)
Vulnerable System Impact Confidentiality (VC): None (N)
Vulnerable System Impact Integrity (VI): None (N)
Vulnerable System Impact Availability (VA): None (N)
Subsequent System Impact Confidentiality (SC): Low (L)
Subsequent System Impact Integrity (SI): Low (L)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): Present (P)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Active (A)
Modified Vulnerable System Impact Confidentiality (MVC): None (N)
Modified Vulnerable System Impact Integrity (MVI): None (N)
Modified Vulnerable System Impact Availability (MVA): None (N)
Modified Subsequent System Impact Confidentiality (MSC): Low (L)
Modified Subsequent System Impact Integrity (MSI): Low (L)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

created 1 day, 16 hours ago Activity log

Created suggestion 1 day, 16 hours ago

Symfony: HtmlSanitizer UrlAttributeSanitizer Omits action/formaction/poster/cite — javascript: URI Survives Sanitization (XSS)

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0-BETA1 until 6.4.40, 7.4.12, and 8.0.12, UrlAttributeSanitizer::getSupportedAttributes() omits URL-valued attributes including action, formaction, poster, and cite, so configurations that admit those attributes can leave javascript: URIs unsanitized and enable XSS when the resulting HTML is rendered or a victim submits a form or clicks a button. This issue is fixed in versions 6.4.40, 7.4.12, and 8.0.12.

References

https://github.com/symfony/symfony/security/advisories/GHSA-hhg7-c65m-h7ff x_refsource_CONFIRM
https://github.com/symfony/symfony/commit/487728e7e180a674a6d4c01bd0cb56161cc441b7 x_refsource_MISC
https://github.com/symfony/symfony/releases/tag/v6.4.40 x_refsource_MISC
https://github.com/symfony/symfony/releases/tag/v7.4.12 x_refsource_MISC
https://github.com/symfony/symfony/releases/tag/v8.0.12 x_refsource_MISC

Affected products

symfony

==>= 6.1.0-BETA1, < 6.4.40
==>= 7.0.0-BETA1, < 7.4.12
==>= 8.0.0-BETA1, < 8.0.12

html-sanitizer

==>= 6.1.0-BETA1, < 6.4.40
==>= 7.0.0-BETA1, < 7.4.12
==>= 8.0.0-BETA1, < 8.0.12

Matching in nixpkgs

pkgs.symfony-cli

Symfony CLI

nixos-unstable 5.17.1
- nixpkgs-unstable 5.17.1
- nixos-unstable-small 5.17.1
nixos-26.05 5.17.1
- nixos-26.05-small 5.17.1
- nixpkgs-26.05-darwin 5.17.1

pkgs.python313Packages.html-sanitizer

Allowlist-based and very opinionated HTML sanitizer

nixos-unstable 2.6
- nixpkgs-unstable 2.6
- nixos-unstable-small 2.6
nixos-26.05 2.6
- nixos-26.05-small 2.6
- nixpkgs-26.05-darwin 2.6

pkgs.python314Packages.html-sanitizer

Allowlist-based and very opinionated HTML sanitizer

nixos-unstable 2.6
- nixpkgs-unstable 2.6
- nixos-unstable-small 2.6
nixos-26.05 2.6
- nixos-26.05-small 2.6
- nixpkgs-26.05-darwin 2.6

pkgs.rubyPackages.rails-html-sanitizer

None

nixos-unstable 1.6.2
- nixpkgs-unstable 1.6.2
- nixos-unstable-small 1.6.2
nixos-26.05 1.6.2
- nixos-26.05-small 1.6.2
- nixpkgs-26.05-darwin 1.6.2

pkgs.rubyPackages_3_3.rails-html-sanitizer

None

nixos-unstable 1.6.2
- nixpkgs-unstable 1.6.2
- nixos-unstable-small 1.6.2
nixos-26.05 1.6.2
- nixos-26.05-small 1.6.2
- nixpkgs-26.05-darwin 1.6.2

pkgs.rubyPackages_3_4.rails-html-sanitizer

None

nixos-unstable 1.6.2
- nixpkgs-unstable 1.6.2
- nixos-unstable-small 1.6.2
nixos-26.05 1.6.2
- nixos-26.05-small 1.6.2
- nixpkgs-26.05-darwin 1.6.2

pkgs.rubyPackages_4_0.rails-html-sanitizer

None

nixos-unstable 1.6.2
- nixpkgs-unstable 1.6.2
- nixos-unstable-small 1.6.2
nixos-26.05 1.6.2
- nixos-26.05-small 1.6.2
- nixpkgs-26.05-darwin 1.6.2

Package maintainers

@fabaff Fabian Affolter <mail@fabian-affolter.ch>
@patka-123 patka <patka@patka.dev>

Untriaged

Permalink CVE-2026-48760

5.3 MEDIUM

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): None (N)
User Interaction (UI): Passive (P)
Vulnerable System Impact Confidentiality (VC): None (N)
Vulnerable System Impact Integrity (VI): None (N)
Vulnerable System Impact Availability (VA): None (N)
Subsequent System Impact Confidentiality (SC): Low (L)
Subsequent System Impact Integrity (SI): Low (L)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Passive (P)
Modified Vulnerable System Impact Confidentiality (MVC): None (N)
Modified Vulnerable System Impact Integrity (MVI): None (N)
Modified Vulnerable System Impact Availability (MVA): None (N)
Modified Subsequent System Impact Confidentiality (MSC): Low (L)
Modified Subsequent System Impact Integrity (MSI): Low (L)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

created 1 day, 16 hours ago Activity log

Created suggestion 1 day, 16 hours ago

Symfony: HtmlSanitizer URL Parser Deny Gates Underinclusive: Percent-Encoded BiDi Marks and Unicode Whitespace Bypass Visual-Spoofing Defense

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0 until 6.4.41, 7.4.13, and 8.0.13, UrlSanitizer::parse() rejected raw BiDi formatting characters but not percent-encoded forms and used an ASCII-only whitespace check, allowing sanitized URLs to retain visual-spoofing characters that downstream consumers could decode or display. This issue is fixed in versions 6.4.41, 7.4.13, and 8.0.13.

References

https://github.com/symfony/symfony/security/advisories/GHSA-v3wm-qf9p-c549 x_refsource_CONFIRM
https://github.com/symfony/symfony/commit/b21a626fd90f5c12d2db432c629eed3e780ba2f8 x_refsource_MISC
https://github.com/symfony/symfony/releases/tag/v6.4.41 x_refsource_MISC
https://github.com/symfony/symfony/releases/tag/v7.4.13 x_refsource_MISC
https://github.com/symfony/symfony/releases/tag/v8.0.13 x_refsource_MISC

Affected products

symfony

==>= 8.0.0-BETA1, < 8.0.13
==>= 6.1.0, < 6.4.41
==>= 7.0.0-BETA1, < 7.4.13

html-sanitizer

==>= 7.0.0-BETA1, < 7.4.13
==>= 6.1.0, < 6.4.41
==>= 8.0.0-BETA1, < 8.0.13

Matching in nixpkgs

pkgs.symfony-cli

Symfony CLI

nixos-unstable 5.17.1
- nixpkgs-unstable 5.17.1
- nixos-unstable-small 5.17.1
nixos-26.05 5.17.1
- nixos-26.05-small 5.17.1
- nixpkgs-26.05-darwin 5.17.1

pkgs.python313Packages.html-sanitizer

Allowlist-based and very opinionated HTML sanitizer

nixos-unstable 2.6
- nixpkgs-unstable 2.6
- nixos-unstable-small 2.6
nixos-26.05 2.6
- nixos-26.05-small 2.6
- nixpkgs-26.05-darwin 2.6

pkgs.python314Packages.html-sanitizer

Allowlist-based and very opinionated HTML sanitizer

nixos-unstable 2.6
- nixpkgs-unstable 2.6
- nixos-unstable-small 2.6
nixos-26.05 2.6
- nixos-26.05-small 2.6
- nixpkgs-26.05-darwin 2.6

pkgs.rubyPackages.rails-html-sanitizer

None

nixos-unstable 1.6.2
- nixpkgs-unstable 1.6.2
- nixos-unstable-small 1.6.2
nixos-26.05 1.6.2
- nixos-26.05-small 1.6.2
- nixpkgs-26.05-darwin 1.6.2

pkgs.rubyPackages_3_3.rails-html-sanitizer

None

nixos-unstable 1.6.2
- nixpkgs-unstable 1.6.2
- nixos-unstable-small 1.6.2
nixos-26.05 1.6.2
- nixos-26.05-small 1.6.2
- nixpkgs-26.05-darwin 1.6.2

pkgs.rubyPackages_3_4.rails-html-sanitizer

None

nixos-unstable 1.6.2
- nixpkgs-unstable 1.6.2
- nixos-unstable-small 1.6.2
nixos-26.05 1.6.2
- nixos-26.05-small 1.6.2
- nixpkgs-26.05-darwin 1.6.2

pkgs.rubyPackages_4_0.rails-html-sanitizer

None

nixos-unstable 1.6.2
- nixpkgs-unstable 1.6.2
- nixos-unstable-small 1.6.2
nixos-26.05 1.6.2
- nixos-26.05-small 1.6.2
- nixpkgs-26.05-darwin 1.6.2

Package maintainers

@fabaff Fabian Affolter <mail@fabian-affolter.ch>
@patka-123 patka <patka@patka.dev>

Untriaged

Permalink CVE-2026-48761

5.3 MEDIUM

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): None (N)
User Interaction (UI): Passive (P)
Vulnerable System Impact Confidentiality (VC): None (N)
Vulnerable System Impact Integrity (VI): None (N)
Vulnerable System Impact Availability (VA): None (N)
Subsequent System Impact Confidentiality (SC): Low (L)
Subsequent System Impact Integrity (SI): Low (L)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Passive (P)
Modified Vulnerable System Impact Confidentiality (MVC): None (N)
Modified Vulnerable System Impact Integrity (MVI): None (N)
Modified Vulnerable System Impact Availability (MVA): None (N)
Modified Subsequent System Impact Confidentiality (MSC): Low (L)
Modified Subsequent System Impact Integrity (MSI): Low (L)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

created 1 day, 16 hours ago Activity log

Created suggestion 1 day, 16 hours ago

Symfony: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes on <object>, <applet>, <iframe>, <img> and the URL Inside <meta http-equiv="refresh"> content

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0 until 6.4.41, 7.4.13, and 8.0.13, UrlAttributeSanitizer::getSupportedAttributes() omitted URL-bearing attributes on <object>, <applet>, <iframe>, and <img>, and <meta http-equiv="refresh"> URLs inside content bypassed URL sanitization, allowing explicitly enabled elements or attributes to pass javascript: and similar payloads into sanitized output. This issue is fixed in versions 6.4.41, 7.4.13, and 8.0.13.

References

https://github.com/symfony/symfony/security/advisories/GHSA-x5qj-865h-mgvm x_refsource_CONFIRM
https://github.com/symfony/symfony/commit/069a70f9f26e61e9de3b7f9a864a86ed24b36bd0 x_refsource_MISC
https://github.com/symfony/symfony/releases/tag/v6.4.41 x_refsource_MISC
https://github.com/symfony/symfony/releases/tag/v7.4.13 x_refsource_MISC
https://github.com/symfony/symfony/releases/tag/v8.0.13 x_refsource_MISC

Affected products

symfony

==>= 7.0.0-BETA1, < 7.4.13
==>= 6.1.0, < 6.4.41
==>= 8.0.0-BETA1, < 8.0.13

html-sanitizer

==>= 7.0.0-BETA1, < 7.4.13
==>= 6.1.0, < 6.4.41
==>= 8.0.0-BETA1, < 8.0.13

Matching in nixpkgs

pkgs.symfony-cli

Symfony CLI

nixos-unstable 5.17.1
- nixpkgs-unstable 5.17.1
- nixos-unstable-small 5.17.1
nixos-26.05 5.17.1
- nixos-26.05-small 5.17.1
- nixpkgs-26.05-darwin 5.17.1

pkgs.python313Packages.html-sanitizer

Allowlist-based and very opinionated HTML sanitizer

nixos-unstable 2.6
- nixpkgs-unstable 2.6
- nixos-unstable-small 2.6
nixos-26.05 2.6
- nixos-26.05-small 2.6
- nixpkgs-26.05-darwin 2.6

pkgs.python314Packages.html-sanitizer

Allowlist-based and very opinionated HTML sanitizer

nixos-unstable 2.6
- nixpkgs-unstable 2.6
- nixos-unstable-small 2.6
nixos-26.05 2.6
- nixos-26.05-small 2.6
- nixpkgs-26.05-darwin 2.6

pkgs.rubyPackages.rails-html-sanitizer

None

nixos-unstable 1.6.2
- nixpkgs-unstable 1.6.2
- nixos-unstable-small 1.6.2
nixos-26.05 1.6.2
- nixos-26.05-small 1.6.2
- nixpkgs-26.05-darwin 1.6.2

pkgs.rubyPackages_3_3.rails-html-sanitizer

None

nixos-unstable 1.6.2
- nixpkgs-unstable 1.6.2
- nixos-unstable-small 1.6.2
nixos-26.05 1.6.2
- nixos-26.05-small 1.6.2
- nixpkgs-26.05-darwin 1.6.2

pkgs.rubyPackages_3_4.rails-html-sanitizer

None

nixos-unstable 1.6.2
- nixpkgs-unstable 1.6.2
- nixos-unstable-small 1.6.2
nixos-26.05 1.6.2
- nixos-26.05-small 1.6.2
- nixpkgs-26.05-darwin 1.6.2

pkgs.rubyPackages_4_0.rails-html-sanitizer

None

nixos-unstable 1.6.2
- nixpkgs-unstable 1.6.2
- nixos-unstable-small 1.6.2
nixos-26.05 1.6.2
- nixos-26.05-small 1.6.2
- nixpkgs-26.05-darwin 1.6.2

Package maintainers

@fabaff Fabian Affolter <mail@fabian-affolter.ch>
@patka-123 patka <patka@patka.dev>

Untriaged

Permalink CVE-2026-45066

2.3 LOW

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): Present (P)
Privileges Required (PR): None (N)
User Interaction (UI): Passive (P)
Vulnerable System Impact Confidentiality (VC): None (N)
Vulnerable System Impact Integrity (VI): None (N)
Vulnerable System Impact Availability (VA): None (N)
Subsequent System Impact Confidentiality (SC): Low (L)
Subsequent System Impact Integrity (SI): Low (L)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): Present (P)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Passive (P)
Modified Vulnerable System Impact Confidentiality (MVC): None (N)
Modified Vulnerable System Impact Integrity (MVI): None (N)
Modified Vulnerable System Impact Availability (MVA): None (N)
Modified Subsequent System Impact Confidentiality (MSC): Low (L)
Modified Subsequent System Impact Integrity (MSI): Low (L)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

created 1 day, 16 hours ago Activity log

Created suggestion 1 day, 16 hours ago

Symfony: HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URL-Parser Differentials and <area> Misclassification

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0-BETA1 until 6.4.40, 7.4.12, and 8.0.12, HtmlSanitizer URL sanitization can allow off-allowlist URLs through allowLinkHosts() or allowMediaHosts() because UrlSanitizer::parse() follows RFC 3986 while browsers follow WHATWG URL parsing, and because <area href> is checked against the media policy rather than the link policy. This issue is fixed in versions 6.4.40, 7.4.12, and 8.0.12.

References

https://github.com/symfony/symfony/security/advisories/GHSA-qc95-4862-92fh x_refsource_CONFIRM
https://github.com/symfony/symfony/commit/d506b556d3d3906f3e8660ad82257ce87edbaac4 x_refsource_MISC
https://github.com/symfony/symfony/releases/tag/v6.4.40 x_refsource_MISC
https://github.com/symfony/symfony/releases/tag/v7.4.12 x_refsource_MISC
https://github.com/symfony/symfony/releases/tag/v8.0.12 x_refsource_MISC

Affected products

symfony

==>= 6.1.0-BETA1, < 6.4.40
==>= 7.0.0-BETA1, < 7.4.12
==>= 8.0.0-BETA1, < 8.0.12

html-sanitizer

==>= 6.1.0-BETA1, < 6.4.40
==>= 7.0.0-BETA1, < 7.4.12
==>= 8.0.0-BETA1, < 8.0.12

Matching in nixpkgs

pkgs.symfony-cli

Symfony CLI

nixos-unstable 5.17.1
- nixpkgs-unstable 5.17.1
- nixos-unstable-small 5.17.1
nixos-26.05 5.17.1
- nixos-26.05-small 5.17.1
- nixpkgs-26.05-darwin 5.17.1

pkgs.python313Packages.html-sanitizer

Allowlist-based and very opinionated HTML sanitizer

nixos-unstable 2.6
- nixpkgs-unstable 2.6
- nixos-unstable-small 2.6
nixos-26.05 2.6
- nixos-26.05-small 2.6
- nixpkgs-26.05-darwin 2.6

pkgs.python314Packages.html-sanitizer

Allowlist-based and very opinionated HTML sanitizer

nixos-unstable 2.6
- nixpkgs-unstable 2.6
- nixos-unstable-small 2.6
nixos-26.05 2.6
- nixos-26.05-small 2.6
- nixpkgs-26.05-darwin 2.6

pkgs.rubyPackages.rails-html-sanitizer

None

nixos-unstable 1.6.2
- nixpkgs-unstable 1.6.2
- nixos-unstable-small 1.6.2
nixos-26.05 1.6.2
- nixos-26.05-small 1.6.2
- nixpkgs-26.05-darwin 1.6.2

pkgs.rubyPackages_3_3.rails-html-sanitizer

None

nixos-unstable 1.6.2
- nixpkgs-unstable 1.6.2
- nixos-unstable-small 1.6.2
nixos-26.05 1.6.2
- nixos-26.05-small 1.6.2
- nixpkgs-26.05-darwin 1.6.2

pkgs.rubyPackages_3_4.rails-html-sanitizer

None

nixos-unstable 1.6.2
- nixpkgs-unstable 1.6.2
- nixos-unstable-small 1.6.2
nixos-26.05 1.6.2
- nixos-26.05-small 1.6.2
- nixpkgs-26.05-darwin 1.6.2

pkgs.rubyPackages_4_0.rails-html-sanitizer

None

nixos-unstable 1.6.2
- nixpkgs-unstable 1.6.2
- nixos-unstable-small 1.6.2
nixos-26.05 1.6.2
- nixos-26.05-small 1.6.2
- nixpkgs-26.05-darwin 1.6.2

Package maintainers

@fabaff Fabian Affolter <mail@fabian-affolter.ch>
@patka-123 patka <patka@patka.dev>

Suggestions search

References

Affected products

Matching in nixpkgs

pkgs.symfony-cli

pkgs.python313Packages.html-sanitizer

pkgs.python314Packages.html-sanitizer

pkgs.rubyPackages.rails-html-sanitizer

pkgs.rubyPackages_3_3.rails-html-sanitizer

pkgs.rubyPackages_3_4.rails-html-sanitizer

pkgs.rubyPackages_4_0.rails-html-sanitizer

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.symfony-cli

pkgs.python313Packages.html-sanitizer

pkgs.python314Packages.html-sanitizer

pkgs.rubyPackages.rails-html-sanitizer

pkgs.rubyPackages_3_3.rails-html-sanitizer

pkgs.rubyPackages_3_4.rails-html-sanitizer

pkgs.rubyPackages_4_0.rails-html-sanitizer

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.symfony-cli

pkgs.python313Packages.html-sanitizer

pkgs.python314Packages.html-sanitizer

pkgs.rubyPackages.rails-html-sanitizer

pkgs.rubyPackages_3_3.rails-html-sanitizer

pkgs.rubyPackages_3_4.rails-html-sanitizer

pkgs.rubyPackages_4_0.rails-html-sanitizer

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.symfony-cli

pkgs.python313Packages.html-sanitizer

pkgs.python314Packages.html-sanitizer

pkgs.rubyPackages.rails-html-sanitizer

pkgs.rubyPackages_3_3.rails-html-sanitizer

pkgs.rubyPackages_3_4.rails-html-sanitizer

pkgs.rubyPackages_4_0.rails-html-sanitizer

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.symfony-cli

pkgs.python313Packages.html-sanitizer

pkgs.python314Packages.html-sanitizer

pkgs.rubyPackages.rails-html-sanitizer

pkgs.rubyPackages_3_3.rails-html-sanitizer

pkgs.rubyPackages_3_4.rails-html-sanitizer

pkgs.rubyPackages_4_0.rails-html-sanitizer

Package maintainers