Symfony: HtmlSanitizer URL Parser Deny Gates Underinclusive: Percent-Encoded BiDi Marks and Unicode Whitespace Bypass Visual-Spoofing Defense
The advisory, in context
Description
Symfony\Component\HtmlSanitizer\TextSanitizer\UrlSanitizer::parse() rejects URLs containing raw Unicode explicit-direction BiDi formatting characters (U+202A–U+202E, U+2066–U+2069) as a defense against visual-spoofing of the rendered href. The check covers only the raw UTF-8 forms of those code points: the percent-encoded forms (%E2%80%AE for U+202E, %E2%81%A6 for U+2066, etc.) are not matched by the deny regex, survive league/uri's parse/build cycle, and are re-emitted unchanged in the sanitized URL. Any downstream consumer that decodes the link before display — phishing-detection filters that compare urldecode($href) against a domain allow-list, audit-log dashboards that show a decoded form for readability, hover-tooltip previews, federated/syndicated content where the decoder lives on the consuming side — restores the BiDi character and the visual spoof that the original defense was filed to prevent.
The same UrlSanitizer::parse() carries an ASCII-only /\s/ whitespace check (no /u modifier) intended as a backstop against malformed URLs. Without the /u modifier, PCRE's \s matches only ASCII whitespace, so Unicode whitespace characters — NBSP (U+00A0), the zero-width no-break space / BOM (U+FEFF), line/paragraph separators (U+2028, U+2029), ogham space (U+1680), the U+2000–U+200A en/em quad family, narrow / medium / ideographic spaces (U+202F, U+205F, U+3000) and NEL (U+0085) — pass through unchanged in both raw and percent-encoded forms. In hostname positions they enable lookalike spoofs (example<NBSP>.com); in path/query/fragment they enable allow-list drift when a downstream consumer strips whitespace before comparison.
Resolution
UrlSanitizer::parse() now denies BiDi formatting marks together with Unicode whitespace and the zero-width no-break space, in both the raw input and the percent-decoded form of each parsed URL component (user, pass, host, path, query, fragment). ASCII space remains tolerated in path/query/fragment via the existing percent-encoding step.
The patches for this issue are available here for branch 6.4 (and forward-ported to 7.4, 8.0 and 8.1).
Credits
Symfony would like to thank Scott Arciszewski (Trail of Bits) for reporting the issue and Nicolas Grekas for providing the fix.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
From 6.1.0 before 6.4.41
Fixed in 6.4.41
33 explicitly affected versions
v6.1.0, v6.1.11, v6.1.9, v6.2.0, v6.2.0-BETA1, v6.2.0-RC1, v6.2.2, v6.2.5, v6.2.7, v6.3.0, v6.3.0-BETA1, v6.3.0-RC1, v6.3.12, v6.3.4, v6.3.7, v6.4.0, v6.4.0-BETA1, v6.4.0-BETA2, v6.4.0-RC1, v6.4.12, v6.4.13, v6.4.17, v6.4.18, v6.4.21, v6.4.24, v6.4.25, v6.4.28, v6.4.3, v6.4.35, v6.4.4, v6.4.40, v6.4.7, v6.4.8
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "6.1.0"
},
{
"fixed": "6.4.41"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v6.1.0",
"v6.1.11",
"v6.1.9",
"v6.2.0",
"v6.2.0-BETA1",
"v6.2.0-RC1",
"v6.2.2",
"v6.2.5",
"v6.2.7",
"v6.3.0",
"v6.3.0-BETA1",
"v6.3.0-RC1",
"v6.3.12",
"v6.3.4",
"v6.3.7",
"v6.4.0",
"v6.4.0-BETA1",
"v6.4.0-BETA2",
"v6.4.0-RC1",
"v6.4.12",
"v6.4.13",
"v6.4.17",
"v6.4.18",
"v6.4.21",
"v6.4.24",
"v6.4.25",
"v6.4.28",
"v6.4.3",
"v6.4.35",
"v6.4.4",
"v6.4.40",
"v6.4.7",
"v6.4.8"
]
}From 7.0.0 before 7.4.13
Fixed in 7.4.13
33 explicitly affected versions
v7.0.0, v7.0.3, v7.0.4, v7.0.7, v7.0.8, v7.1.0, v7.1.0-BETA1, v7.1.0-RC1, v7.1.1, v7.1.10, v7.1.11, v7.1.5, v7.1.6, v7.2.0, v7.2.0-BETA1, v7.2.0-RC1, v7.2.2, v7.2.3, v7.2.6, v7.2.9, v7.3.0, v7.3.0-BETA1, v7.3.0-RC1, v7.3.2, v7.3.3, v7.3.6, v7.4.0, v7.4.0-BETA1, v7.4.0-BETA2, v7.4.0-RC1, v7.4.12, v7.4.7, v7.4.8
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "7.0.0"
},
{
"fixed": "7.4.13"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v7.0.0",
"v7.0.3",
"v7.0.4",
"v7.0.7",
"v7.0.8",
"v7.1.0",
"v7.1.0-BETA1",
"v7.1.0-RC1",
"v7.1.1",
"v7.1.10",
"v7.1.11",
"v7.1.5",
"v7.1.6",
"v7.2.0",
"v7.2.0-BETA1",
"v7.2.0-RC1",
"v7.2.2",
"v7.2.3",
"v7.2.6",
"v7.2.9",
"v7.3.0",
"v7.3.0-BETA1",
"v7.3.0-RC1",
"v7.3.2",
"v7.3.3",
"v7.3.6",
"v7.4.0",
"v7.4.0-BETA1",
"v7.4.0-BETA2",
"v7.4.0-RC1",
"v7.4.12",
"v7.4.7",
"v7.4.8"
]
}From 8.0.0 before 8.0.13
Fixed in 8.0.13
4 explicitly affected versions
v8.0.0, v8.0.12, v8.0.7, v8.0.8
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "8.0.0"
},
{
"fixed": "8.0.13"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v8.0.0",
"v8.0.12",
"v8.0.7",
"v8.0.8"
]
}From 6.1.0 before 6.4.41
Fixed in 6.4.41
97 explicitly affected versions
v6.1.0, v6.1.1, v6.1.10, v6.1.11, v6.1.12, v6.1.2, v6.1.3, v6.1.4, v6.1.5, v6.1.6, v6.1.7, v6.1.8, v6.1.9, v6.2.0, v6.2.0-BETA1, v6.2.0-BETA2, v6.2.0-BETA3, v6.2.0-RC1, v6.2.0-RC2, v6.2.1, v6.2.10, v6.2.11, v6.2.12, v6.2.13, v6.2.14, v6.2.2, v6.2.3, v6.2.4, v6.2.5, v6.2.6, v6.2.7, v6.2.8, v6.2.9, v6.3.0, v6.3.0-BETA1, v6.3.0-BETA2, v6.3.0-BETA3, v6.3.0-RC1, v6.3.0-RC2, v6.3.1, v6.3.10, v6.3.11, v6.3.12, v6.3.2, v6.3.3, v6.3.4, v6.3.5, v6.3.6, v6.3.7, v6.3.8, v6.3.9, v6.4.0, v6.4.0-BETA1, v6.4.0-BETA2, v6.4.0-BETA3, v6.4.0-RC1, v6.4.0-RC2, v6.4.1, v6.4.10, v6.4.11, v6.4.12, v6.4.13, v6.4.14, v6.4.15, v6.4.16, v6.4.17, v6.4.18, v6.4.19, v6.4.2, v6.4.20, v6.4.21, v6.4.22, v6.4.23, v6.4.24, v6.4.25, v6.4.26, v6.4.27, v6.4.28, v6.4.29, v6.4.3, v6.4.30, v6.4.31, v6.4.32, v6.4.33, v6.4.34, v6.4.35, v6.4.36, v6.4.37, v6.4.38, v6.4.39, v6.4.4, v6.4.40, v6.4.5, v6.4.6, v6.4.7, v6.4.8, v6.4.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "6.1.0"
},
{
"fixed": "6.4.41"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v6.1.0",
"v6.1.1",
"v6.1.10",
"v6.1.11",
"v6.1.12",
"v6.1.2",
"v6.1.3",
"v6.1.4",
"v6.1.5",
"v6.1.6",
"v6.1.7",
"v6.1.8",
"v6.1.9",
"v6.2.0",
"v6.2.0-BETA1",
"v6.2.0-BETA2",
"v6.2.0-BETA3",
"v6.2.0-RC1",
"v6.2.0-RC2",
"v6.2.1",
"v6.2.10",
"v6.2.11",
"v6.2.12",
"v6.2.13",
"v6.2.14",
"v6.2.2",
"v6.2.3",
"v6.2.4",
"v6.2.5",
"v6.2.6",
"v6.2.7",
"v6.2.8",
"v6.2.9",
"v6.3.0",
"v6.3.0-BETA1",
"v6.3.0-BETA2",
"v6.3.0-BETA3",
"v6.3.0-RC1",
"v6.3.0-RC2",
"v6.3.1",
"v6.3.10",
"v6.3.11",
"v6.3.12",
"v6.3.2",
"v6.3.3",
"v6.3.4",
"v6.3.5",
"v6.3.6",
"v6.3.7",
"v6.3.8",
"v6.3.9",
"v6.4.0",
"v6.4.0-BETA1",
"v6.4.0-BETA2",
"v6.4.0-BETA3",
"v6.4.0-RC1",
"v6.4.0-RC2",
"v6.4.1",
"v6.4.10",
"v6.4.11",
"v6.4.12",
"v6.4.13",
"v6.4.14",
"v6.4.15",
"v6.4.16",
"v6.4.17",
"v6.4.18",
"v6.4.19",
"v6.4.2",
"v6.4.20",
"v6.4.21",
"v6.4.22",
"v6.4.23",
"v6.4.24",
"v6.4.25",
"v6.4.26",
"v6.4.27",
"v6.4.28",
"v6.4.29",
"v6.4.3",
"v6.4.30",
"v6.4.31",
"v6.4.32",
"v6.4.33",
"v6.4.34",
"v6.4.35",
"v6.4.36",
"v6.4.37",
"v6.4.38",
"v6.4.39",
"v6.4.4",
"v6.4.40",
"v6.4.5",
"v6.4.6",
"v6.4.7",
"v6.4.8",
"v6.4.9"
]
}From 7.0.0 before 7.4.13
Fixed in 7.4.13
71 explicitly affected versions
v7.0.0, v7.0.1, v7.0.10, v7.0.2, v7.0.3, v7.0.4, v7.0.5, v7.0.6, v7.0.7, v7.0.8, v7.0.9, v7.1.0, v7.1.0-BETA1, v7.1.0-RC1, v7.1.1, v7.1.10, v7.1.11, v7.1.2, v7.1.3, v7.1.4, v7.1.5, v7.1.6, v7.1.7, v7.1.8, v7.1.9, v7.2.0, v7.2.0-BETA1, v7.2.0-BETA2, v7.2.0-RC1, v7.2.1, v7.2.2, v7.2.3, v7.2.4, v7.2.5, v7.2.6, v7.2.7, v7.2.8, v7.2.9, v7.3.0, v7.3.0-BETA1, v7.3.0-BETA2, v7.3.0-RC1, v7.3.1, v7.3.10, v7.3.11, v7.3.2, v7.3.3, v7.3.4, v7.3.5, v7.3.6, v7.3.7, v7.3.8, v7.3.9, v7.4.0, v7.4.0-BETA1, v7.4.0-BETA2, v7.4.0-RC1, v7.4.0-RC2, v7.4.0-RC3, v7.4.1, v7.4.10, v7.4.11, v7.4.12, v7.4.2, v7.4.3, v7.4.4, v7.4.5, v7.4.6, v7.4.7, v7.4.8, v7.4.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "7.0.0"
},
{
"fixed": "7.4.13"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v7.0.0",
"v7.0.1",
"v7.0.10",
"v7.0.2",
"v7.0.3",
"v7.0.4",
"v7.0.5",
"v7.0.6",
"v7.0.7",
"v7.0.8",
"v7.0.9",
"v7.1.0",
"v7.1.0-BETA1",
"v7.1.0-RC1",
"v7.1.1",
"v7.1.10",
"v7.1.11",
"v7.1.2",
"v7.1.3",
"v7.1.4",
"v7.1.5",
"v7.1.6",
"v7.1.7",
"v7.1.8",
"v7.1.9",
"v7.2.0",
"v7.2.0-BETA1",
"v7.2.0-BETA2",
"v7.2.0-RC1",
"v7.2.1",
"v7.2.2",
"v7.2.3",
"v7.2.4",
"v7.2.5",
"v7.2.6",
"v7.2.7",
"v7.2.8",
"v7.2.9",
"v7.3.0",
"v7.3.0-BETA1",
"v7.3.0-BETA2",
"v7.3.0-RC1",
"v7.3.1",
"v7.3.10",
"v7.3.11",
"v7.3.2",
"v7.3.3",
"v7.3.4",
"v7.3.5",
"v7.3.6",
"v7.3.7",
"v7.3.8",
"v7.3.9",
"v7.4.0",
"v7.4.0-BETA1",
"v7.4.0-BETA2",
"v7.4.0-RC1",
"v7.4.0-RC2",
"v7.4.0-RC3",
"v7.4.1",
"v7.4.10",
"v7.4.11",
"v7.4.12",
"v7.4.2",
"v7.4.3",
"v7.4.4",
"v7.4.5",
"v7.4.6",
"v7.4.7",
"v7.4.8",
"v7.4.9"
]
}From 8.0.0 before 8.0.13
Fixed in 8.0.13
13 explicitly affected versions
v8.0.0, v8.0.1, v8.0.10, v8.0.11, v8.0.12, v8.0.2, v8.0.3, v8.0.4, v8.0.5, v8.0.6, v8.0.7, v8.0.8, v8.0.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "8.0.0"
},
{
"fixed": "8.0.13"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v8.0.0",
"v8.0.1",
"v8.0.10",
"v8.0.11",
"v8.0.12",
"v8.0.2",
"v8.0.3",
"v8.0.4",
"v8.0.5",
"v8.0.6",
"v8.0.7",
"v8.0.8",
"v8.0.9"
]
}References
- https://github.com/symfony/symfony/security/advisories/GHSA-v3wm-qf9p-c549
- https://github.com/symfony/symfony/commit/b21a626fd90f5c12d2db432c629eed3e780ba2f8
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/html-sanitizer/CVE-2026-48760.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2026-48760.yaml
- https://github.com/symfony/symfony
- https://symfony.com/cve-2026-48760