{"items":[{"id":"NVI-00006791","kind":"vulnerability","title":"Symfony: HtmlSanitizer URL Parser Deny Gates Underinclusive: Percent-Encoded BiDi Marks and Unicode Whitespace Bypass Visual-Spoofing Defense","revision":3,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-v3wm-qf9p-c549","CVE-2026-48760"],"plain_summary":"GitHub lists this reviewed advisory for symfony/html-sanitizer, symfony/html-sanitizer, symfony/html-sanitizer, symfony/symfony, symfony/symfony. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-25f6f9cb768313022ebec4b3fd374b4b"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 6.4.41 for symfony/html-sanitizer. Confirm the publisher’s latest guidance.","source_ids":["sr-c2acf9ef0aabe93198b0eae9251c000c"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 7.4.13 for symfony/html-sanitizer. Confirm the publisher’s latest guidance.","source_ids":["sr-c2acf9ef0aabe93198b0eae9251c000c"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 8.0.13 for symfony/html-sanitizer. Confirm the publisher’s latest guidance.","source_ids":["sr-c2acf9ef0aabe93198b0eae9251c000c"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 6.4.41 for symfony/symfony. Confirm the publisher’s latest guidance.","source_ids":["sr-c2acf9ef0aabe93198b0eae9251c000c"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 7.4.13 for symfony/symfony. Confirm the publisher’s latest guidance.","source_ids":["sr-c2acf9ef0aabe93198b0eae9251c000c"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 8.0.13 for symfony/symfony. Confirm the publisher’s latest guidance.","source_ids":["sr-c2acf9ef0aabe93198b0eae9251c000c"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"EPSS","as_of":"2026-10-31T12:00:27.000Z","value":"0.338%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.27246. Missing scores are unknown.","source_id":"sr-25f6f9cb768313022ebec4b3fd374b4b"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-3076ecb54f22584e4f7c1d3da6e718e9","url":"https://github.com/advisories/GHSA-v3wm-qf9p-c549","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-v3wm-qf9p-c549","publisher":"GitHub Advisory Database","observed_at":"2026-11-06T15:12:54.193Z"},{"id":"sr-c2acf9ef0aabe93198b0eae9251c000c","url":"https://github.com/advisories/GHSA-v3wm-qf9p-c549","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-v3wm-qf9p-c549","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:42:41.369Z"},{"id":"sr-25f6f9cb768313022ebec4b3fd374b4b","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2026-48760","publisher":"FIRST EPSS","observed_at":"2026-10-31T22:06:15.381Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-3076ecb54f22584e4f7c1d3da6e718e9"],"technology":"symfony/html-sanitizer","known_exclusions":[],"conditions_summary":"### Description\n\n`Symfony\\Component\\HtmlSanitizer\\TextSanitizer\\UrlSanitizer::parse()` rejects URLs containing raw Unicode explicit-direction BiDi formatting characters (U+202A–U+202E, U+2066–U+2069) as a defense against visual-spoofing of the rendered `href`. The check covers only the raw UTF-8 forms of those code points: the percent-encoded forms (`%E2%80%AE` for U+202E, `%E2%81%A6` for U+2066, etc.) are not matched by the deny regex, survive `league/uri`'s parse/build cycle, and are re-emitted unchanged in the sanitized URL. Any downstream consumer that decodes the link before display — phishing-detection filters that compare `urldecode($href)` against a domain allow-list, audit-log dashboards that show a decoded form for readability, hover-tooltip previews, federated/syndicated content where the decoder lives on the consuming side — restores the BiDi character and the visual spoof that the original defense was filed to prevent.\n\nThe same `UrlSanitizer::parse()` carries an ASCII-only `/\\s/` whitespace check (no `/u` modifier) intended as a backstop against malformed URLs. Without the `/u` modifier, PCRE's `\\s` matches only ASCII whitespace, so Unicode whitespace characters — NBS","public_affected_ranges":[">= 6.1.0, < 6.4.41"]},{"certainty":"source_listed","source_ids":["sr-3076ecb54f22584e4f7c1d3da6e718e9"],"technology":"symfony/html-sanitizer","known_exclusions":[],"conditions_summary":"### Description\n\n`Symfony\\Component\\HtmlSanitizer\\TextSanitizer\\UrlSanitizer::parse()` rejects URLs containing raw Unicode explicit-direction BiDi formatting characters (U+202A–U+202E, U+2066–U+2069) as a defense against visual-spoofing of the rendered `href`. The check covers only the raw UTF-8 forms of those code points: the percent-encoded forms (`%E2%80%AE` for U+202E, `%E2%81%A6` for U+2066, etc.) are not matched by the deny regex, survive `league/uri`'s parse/build cycle, and are re-emitted unchanged in the sanitized URL. Any downstream consumer that decodes the link before display — phishing-detection filters that compare `urldecode($href)` against a domain allow-list, audit-log dashboards that show a decoded form for readability, hover-tooltip previews, federated/syndicated content where the decoder lives on the consuming side — restores the BiDi character and the visual spoof that the original defense was filed to prevent.\n\nThe same `UrlSanitizer::parse()` carries an ASCII-only `/\\s/` whitespace check (no `/u` modifier) intended as a backstop against malformed URLs. Without the `/u` modifier, PCRE's `\\s` matches only ASCII whitespace, so Unicode whitespace characters — NBS","public_affected_ranges":[">= 7.0.0, < 7.4.13"]},{"certainty":"source_listed","source_ids":["sr-3076ecb54f22584e4f7c1d3da6e718e9"],"technology":"symfony/html-sanitizer","known_exclusions":[],"conditions_summary":"### Description\n\n`Symfony\\Component\\HtmlSanitizer\\TextSanitizer\\UrlSanitizer::parse()` rejects URLs containing raw Unicode explicit-direction BiDi formatting characters (U+202A–U+202E, U+2066–U+2069) as a defense against visual-spoofing of the rendered `href`. The check covers only the raw UTF-8 forms of those code points: the percent-encoded forms (`%E2%80%AE` for U+202E, `%E2%81%A6` for U+2066, etc.) are not matched by the deny regex, survive `league/uri`'s parse/build cycle, and are re-emitted unchanged in the sanitized URL. Any downstream consumer that decodes the link before display — phishing-detection filters that compare `urldecode($href)` against a domain allow-list, audit-log dashboards that show a decoded form for readability, hover-tooltip previews, federated/syndicated content where the decoder lives on the consuming side — restores the BiDi character and the visual spoof that the original defense was filed to prevent.\n\nThe same `UrlSanitizer::parse()` carries an ASCII-only `/\\s/` whitespace check (no `/u` modifier) intended as a backstop against malformed URLs. Without the `/u` modifier, PCRE's `\\s` matches only ASCII whitespace, so Unicode whitespace characters — NBS","public_affected_ranges":[">= 8.0.0, < 8.0.13"]},{"certainty":"source_listed","source_ids":["sr-3076ecb54f22584e4f7c1d3da6e718e9"],"technology":"symfony/symfony","known_exclusions":[],"conditions_summary":"### Description\n\n`Symfony\\Component\\HtmlSanitizer\\TextSanitizer\\UrlSanitizer::parse()` rejects URLs containing raw Unicode explicit-direction BiDi formatting characters (U+202A–U+202E, U+2066–U+2069) as a defense against visual-spoofing of the rendered `href`. The check covers only the raw UTF-8 forms of those code points: the percent-encoded forms (`%E2%80%AE` for U+202E, `%E2%81%A6` for U+2066, etc.) are not matched by the deny regex, survive `league/uri`'s parse/build cycle, and are re-emitted unchanged in the sanitized URL. Any downstream consumer that decodes the link before display — phishing-detection filters that compare `urldecode($href)` against a domain allow-list, audit-log dashboards that show a decoded form for readability, hover-tooltip previews, federated/syndicated content where the decoder lives on the consuming side — restores the BiDi character and the visual spoof that the original defense was filed to prevent.\n\nThe same `UrlSanitizer::parse()` carries an ASCII-only `/\\s/` whitespace check (no `/u` modifier) intended as a backstop against malformed URLs. Without the `/u` modifier, PCRE's `\\s` matches only ASCII whitespace, so Unicode whitespace characters — NBS","public_affected_ranges":[">= 6.1.0, < 6.4.41"]},{"certainty":"source_listed","source_ids":["sr-3076ecb54f22584e4f7c1d3da6e718e9"],"technology":"symfony/symfony","known_exclusions":[],"conditions_summary":"### Description\n\n`Symfony\\Component\\HtmlSanitizer\\TextSanitizer\\UrlSanitizer::parse()` rejects URLs containing raw Unicode explicit-direction BiDi formatting characters (U+202A–U+202E, U+2066–U+2069) as a defense against visual-spoofing of the rendered `href`. The check covers only the raw UTF-8 forms of those code points: the percent-encoded forms (`%E2%80%AE` for U+202E, `%E2%81%A6` for U+2066, etc.) are not matched by the deny regex, survive `league/uri`'s parse/build cycle, and are re-emitted unchanged in the sanitized URL. Any downstream consumer that decodes the link before display — phishing-detection filters that compare `urldecode($href)` against a domain allow-list, audit-log dashboards that show a decoded form for readability, hover-tooltip previews, federated/syndicated content where the decoder lives on the consuming side — restores the BiDi character and the visual spoof that the original defense was filed to prevent.\n\nThe same `UrlSanitizer::parse()` carries an ASCII-only `/\\s/` whitespace check (no `/u` modifier) intended as a backstop against malformed URLs. Without the `/u` modifier, PCRE's `\\s` matches only ASCII whitespace, so Unicode whitespace characters — NBS","public_affected_ranges":[">= 7.0.0, < 7.4.13"]},{"certainty":"source_listed","source_ids":["sr-3076ecb54f22584e4f7c1d3da6e718e9"],"technology":"symfony/symfony","known_exclusions":[],"conditions_summary":"### Description\n\n`Symfony\\Component\\HtmlSanitizer\\TextSanitizer\\UrlSanitizer::parse()` rejects URLs containing raw Unicode explicit-direction BiDi formatting characters (U+202A–U+202E, U+2066–U+2069) as a defense against visual-spoofing of the rendered `href`. The check covers only the raw UTF-8 forms of those code points: the percent-encoded forms (`%E2%80%AE` for U+202E, `%E2%81%A6` for U+2066, etc.) are not matched by the deny regex, survive `league/uri`'s parse/build cycle, and are re-emitted unchanged in the sanitized URL. Any downstream consumer that decodes the link before display — phishing-detection filters that compare `urldecode($href)` against a domain allow-list, audit-log dashboards that show a decoded form for readability, hover-tooltip previews, federated/syndicated content where the decoder lives on the consuming side — restores the BiDi character and the visual spoof that the original defense was filed to prevent.\n\nThe same `UrlSanitizer::parse()` carries an ASCII-only `/\\s/` whitespace check (no `/u` modifier) intended as a backstop against malformed URLs. Without the `/u` modifier, PCRE's `\\s` matches only ASCII whitespace, so Unicode whitespace characters — NBS","public_affected_ranges":[">= 8.0.0, < 8.0.13"]},{"certainty":"source_listed","source_ids":["sr-c2acf9ef0aabe93198b0eae9251c000c"],"technology":"symfony/html-sanitizer","known_exclusions":[],"conditions_summary":"### Description\n\n`Symfony\\Component\\HtmlSanitizer\\TextSanitizer\\UrlSanitizer::parse()` rejects URLs containing raw Unicode explicit-direction BiDi formatting characters (U+202A–U+202E, U+2066–U+2069) as a defense against visual-spoofing of the rendered `href`. The check covers only the raw UTF-8 forms of those code points: the percent-encoded forms (`%E2%80%AE` for U+202E, `%E2%81%A6` for U+2066, etc.) are not matched by the deny regex, survive `league/uri`'s parse/build cycle, and are re-emitted unchanged in the sanitized URL. Any downstream consumer that decodes the link before display — phishing-detection filters that compare `urldecode($href)` against a domain allow-list, audit-log dashboards that show a decoded form for readability, hover-tooltip previews, federated/syndicated content where the decoder lives on the consuming side — restores the BiDi character and the visual spoof that the original defense was filed to prevent.\n\nThe same `UrlSanitizer::parse()` carries an ASCII-only `/\\s/` whitespace check (no `/u` modifier) intended as a backstop against malformed URLs. Without the `/u` modifier, PCRE's `\\s` matches only ASCII whitespace, so Unicode whitespace characters — NBS","public_affected_ranges":["ECOSYSTEM: introduced 6.1.0; fixed 6.4.41"]},{"certainty":"source_listed","source_ids":["sr-c2acf9ef0aabe93198b0eae9251c000c"],"technology":"symfony/html-sanitizer","known_exclusions":[],"conditions_summary":"### Description\n\n`Symfony\\Component\\HtmlSanitizer\\TextSanitizer\\UrlSanitizer::parse()` rejects URLs containing raw Unicode explicit-direction BiDi formatting characters (U+202A–U+202E, U+2066–U+2069) as a defense against visual-spoofing of the rendered `href`. The check covers only the raw UTF-8 forms of those code points: the percent-encoded forms (`%E2%80%AE` for U+202E, `%E2%81%A6` for U+2066, etc.) are not matched by the deny regex, survive `league/uri`'s parse/build cycle, and are re-emitted unchanged in the sanitized URL. Any downstream consumer that decodes the link before display — phishing-detection filters that compare `urldecode($href)` against a domain allow-list, audit-log dashboards that show a decoded form for readability, hover-tooltip previews, federated/syndicated content where the decoder lives on the consuming side — restores the BiDi character and the visual spoof that the original defense was filed to prevent.\n\nThe same `UrlSanitizer::parse()` carries an ASCII-only `/\\s/` whitespace check (no `/u` modifier) intended as a backstop against malformed URLs. Without the `/u` modifier, PCRE's `\\s` matches only ASCII whitespace, so Unicode whitespace characters — NBS","public_affected_ranges":["ECOSYSTEM: introduced 7.0.0; fixed 7.4.13"]},{"certainty":"source_listed","source_ids":["sr-c2acf9ef0aabe93198b0eae9251c000c"],"technology":"symfony/html-sanitizer","known_exclusions":[],"conditions_summary":"### Description\n\n`Symfony\\Component\\HtmlSanitizer\\TextSanitizer\\UrlSanitizer::parse()` rejects URLs containing raw Unicode explicit-direction BiDi formatting characters (U+202A–U+202E, U+2066–U+2069) as a defense against visual-spoofing of the rendered `href`. The check covers only the raw UTF-8 forms of those code points: the percent-encoded forms (`%E2%80%AE` for U+202E, `%E2%81%A6` for U+2066, etc.) are not matched by the deny regex, survive `league/uri`'s parse/build cycle, and are re-emitted unchanged in the sanitized URL. Any downstream consumer that decodes the link before display — phishing-detection filters that compare `urldecode($href)` against a domain allow-list, audit-log dashboards that show a decoded form for readability, hover-tooltip previews, federated/syndicated content where the decoder lives on the consuming side — restores the BiDi character and the visual spoof that the original defense was filed to prevent.\n\nThe same `UrlSanitizer::parse()` carries an ASCII-only `/\\s/` whitespace check (no `/u` modifier) intended as a backstop against malformed URLs. Without the `/u` modifier, PCRE's `\\s` matches only ASCII whitespace, so Unicode whitespace characters — NBS","public_affected_ranges":["ECOSYSTEM: introduced 8.0.0; fixed 8.0.13"]},{"certainty":"source_listed","source_ids":["sr-c2acf9ef0aabe93198b0eae9251c000c"],"technology":"symfony/symfony","known_exclusions":[],"conditions_summary":"### Description\n\n`Symfony\\Component\\HtmlSanitizer\\TextSanitizer\\UrlSanitizer::parse()` rejects URLs containing raw Unicode explicit-direction BiDi formatting characters (U+202A–U+202E, U+2066–U+2069) as a defense against visual-spoofing of the rendered `href`. The check covers only the raw UTF-8 forms of those code points: the percent-encoded forms (`%E2%80%AE` for U+202E, `%E2%81%A6` for U+2066, etc.) are not matched by the deny regex, survive `league/uri`'s parse/build cycle, and are re-emitted unchanged in the sanitized URL. Any downstream consumer that decodes the link before display — phishing-detection filters that compare `urldecode($href)` against a domain allow-list, audit-log dashboards that show a decoded form for readability, hover-tooltip previews, federated/syndicated content where the decoder lives on the consuming side — restores the BiDi character and the visual spoof that the original defense was filed to prevent.\n\nThe same `UrlSanitizer::parse()` carries an ASCII-only `/\\s/` whitespace check (no `/u` modifier) intended as a backstop against malformed URLs. Without the `/u` modifier, PCRE's `\\s` matches only ASCII whitespace, so Unicode whitespace characters — NBS","public_affected_ranges":["ECOSYSTEM: introduced 6.1.0; fixed 6.4.41"]},{"certainty":"source_listed","source_ids":["sr-c2acf9ef0aabe93198b0eae9251c000c"],"technology":"symfony/symfony","known_exclusions":[],"conditions_summary":"### Description\n\n`Symfony\\Component\\HtmlSanitizer\\TextSanitizer\\UrlSanitizer::parse()` rejects URLs containing raw Unicode explicit-direction BiDi formatting characters (U+202A–U+202E, U+2066–U+2069) as a defense against visual-spoofing of the rendered `href`. The check covers only the raw UTF-8 forms of those code points: the percent-encoded forms (`%E2%80%AE` for U+202E, `%E2%81%A6` for U+2066, etc.) are not matched by the deny regex, survive `league/uri`'s parse/build cycle, and are re-emitted unchanged in the sanitized URL. Any downstream consumer that decodes the link before display — phishing-detection filters that compare `urldecode($href)` against a domain allow-list, audit-log dashboards that show a decoded form for readability, hover-tooltip previews, federated/syndicated content where the decoder lives on the consuming side — restores the BiDi character and the visual spoof that the original defense was filed to prevent.\n\nThe same `UrlSanitizer::parse()` carries an ASCII-only `/\\s/` whitespace check (no `/u` modifier) intended as a backstop against malformed URLs. Without the `/u` modifier, PCRE's `\\s` matches only ASCII whitespace, so Unicode whitespace characters — NBS","public_affected_ranges":["ECOSYSTEM: introduced 7.0.0; fixed 7.4.13"]},{"certainty":"source_listed","source_ids":["sr-c2acf9ef0aabe93198b0eae9251c000c"],"technology":"symfony/symfony","known_exclusions":[],"conditions_summary":"### Description\n\n`Symfony\\Component\\HtmlSanitizer\\TextSanitizer\\UrlSanitizer::parse()` rejects URLs containing raw Unicode explicit-direction BiDi formatting characters (U+202A–U+202E, U+2066–U+2069) as a defense against visual-spoofing of the rendered `href`. The check covers only the raw UTF-8 forms of those code points: the percent-encoded forms (`%E2%80%AE` for U+202E, `%E2%81%A6` for U+2066, etc.) are not matched by the deny regex, survive `league/uri`'s parse/build cycle, and are re-emitted unchanged in the sanitized URL. Any downstream consumer that decodes the link before display — phishing-detection filters that compare `urldecode($href)` against a domain allow-list, audit-log dashboards that show a decoded form for readability, hover-tooltip previews, federated/syndicated content where the decoder lives on the consuming side — restores the BiDi character and the visual spoof that the original defense was filed to prevent.\n\nThe same `UrlSanitizer::parse()` carries an ASCII-only `/\\s/` whitespace check (no `/u` modifier) intended as a backstop against malformed URLs. Without the `/u` modifier, PCRE's `\\s` matches only ASCII whitespace, so Unicode whitespace characters — NBS","public_affected_ranges":["ECOSYSTEM: introduced 8.0.0; fixed 8.0.13"]}],"null_published_at":"2026-11-07T07:07:39.842Z","source_updated_at":"2026-06-15T17:32:59.000Z","source_disclosed_at":"2026-06-15T17:32:59.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Source facts changed; compare the preserved prior revision.","null_first_observed_at":"2026-10-31T21:42:41.369Z"},{"id":"NVI-00006791","kind":"vulnerability","title":"Symfony: HtmlSanitizer URL Parser Deny Gates Underinclusive: Percent-Encoded BiDi Marks and Unicode Whitespace Bypass Visual-Spoofing Defense","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-v3wm-qf9p-c549","CVE-2026-48760"],"plain_summary":"OSV carries this publisher advisory for symfony/html-sanitizer, symfony/html-sanitizer, symfony/html-sanitizer, symfony/symfony, symfony/symfony. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"The original advisory lists fixed boundaries 6.4.41 for symfony/html-sanitizer. Confirm the publisher’s latest guidance.","source_ids":["sr-c2acf9ef0aabe93198b0eae9251c000c"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 7.4.13 for symfony/html-sanitizer. Confirm the publisher’s latest guidance.","source_ids":["sr-c2acf9ef0aabe93198b0eae9251c000c"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 8.0.13 for symfony/html-sanitizer. Confirm the publisher’s latest guidance.","source_ids":["sr-c2acf9ef0aabe93198b0eae9251c000c"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 6.4.41 for symfony/symfony. Confirm the publisher’s latest guidance.","source_ids":["sr-c2acf9ef0aabe93198b0eae9251c000c"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 7.4.13 for symfony/symfony. Confirm the publisher’s latest guidance.","source_ids":["sr-c2acf9ef0aabe93198b0eae9251c000c"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 8.0.13 for symfony/symfony. Confirm the publisher’s latest guidance.","source_ids":["sr-c2acf9ef0aabe93198b0eae9251c000c"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-25f6f9cb768313022ebec4b3fd374b4b"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"EPSS","as_of":"2026-10-31T12:00:27.000Z","value":"0.338%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.27246. Missing scores are unknown.","source_id":"sr-25f6f9cb768313022ebec4b3fd374b4b"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-c2acf9ef0aabe93198b0eae9251c000c","url":"https://github.com/advisories/GHSA-v3wm-qf9p-c549","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-v3wm-qf9p-c549","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:42:41.369Z"},{"id":"sr-25f6f9cb768313022ebec4b3fd374b4b","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2026-48760","publisher":"FIRST EPSS","observed_at":"2026-10-31T22:06:15.381Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-c2acf9ef0aabe93198b0eae9251c000c"],"technology":"symfony/html-sanitizer","known_exclusions":[],"conditions_summary":"### Description\n\n`Symfony\\Component\\HtmlSanitizer\\TextSanitizer\\UrlSanitizer::parse()` rejects URLs containing raw Unicode explicit-direction BiDi formatting characters (U+202A–U+202E, U+2066–U+2069) as a defense against visual-spoofing of the rendered `href`. The check covers only the raw UTF-8 forms of those code points: the percent-encoded forms (`%E2%80%AE` for U+202E, `%E2%81%A6` for U+2066, etc.) are not matched by the deny regex, survive `league/uri`'s parse/build cycle, and are re-emitted unchanged in the sanitized URL. Any downstream consumer that decodes the link before display — phishing-detection filters that compare `urldecode($href)` against a domain allow-list, audit-log dashboards that show a decoded form for readability, hover-tooltip previews, federated/syndicated content where the decoder lives on the consuming side — restores the BiDi character and the visual spoof that the original defense was filed to prevent.\n\nThe same `UrlSanitizer::parse()` carries an ASCII-only `/\\s/` whitespace check (no `/u` modifier) intended as a backstop against malformed URLs. Without the `/u` modifier, PCRE's `\\s` matches only ASCII whitespace, so Unicode whitespace characters — NBS","public_affected_ranges":["ECOSYSTEM: introduced 6.1.0; fixed 6.4.41"]},{"certainty":"source_listed","source_ids":["sr-c2acf9ef0aabe93198b0eae9251c000c"],"technology":"symfony/html-sanitizer","known_exclusions":[],"conditions_summary":"### Description\n\n`Symfony\\Component\\HtmlSanitizer\\TextSanitizer\\UrlSanitizer::parse()` rejects URLs containing raw Unicode explicit-direction BiDi formatting characters (U+202A–U+202E, U+2066–U+2069) as a defense against visual-spoofing of the rendered `href`. The check covers only the raw UTF-8 forms of those code points: the percent-encoded forms (`%E2%80%AE` for U+202E, `%E2%81%A6` for U+2066, etc.) are not matched by the deny regex, survive `league/uri`'s parse/build cycle, and are re-emitted unchanged in the sanitized URL. Any downstream consumer that decodes the link before display — phishing-detection filters that compare `urldecode($href)` against a domain allow-list, audit-log dashboards that show a decoded form for readability, hover-tooltip previews, federated/syndicated content where the decoder lives on the consuming side — restores the BiDi character and the visual spoof that the original defense was filed to prevent.\n\nThe same `UrlSanitizer::parse()` carries an ASCII-only `/\\s/` whitespace check (no `/u` modifier) intended as a backstop against malformed URLs. Without the `/u` modifier, PCRE's `\\s` matches only ASCII whitespace, so Unicode whitespace characters — NBS","public_affected_ranges":["ECOSYSTEM: introduced 7.0.0; fixed 7.4.13"]},{"certainty":"source_listed","source_ids":["sr-c2acf9ef0aabe93198b0eae9251c000c"],"technology":"symfony/html-sanitizer","known_exclusions":[],"conditions_summary":"### Description\n\n`Symfony\\Component\\HtmlSanitizer\\TextSanitizer\\UrlSanitizer::parse()` rejects URLs containing raw Unicode explicit-direction BiDi formatting characters (U+202A–U+202E, U+2066–U+2069) as a defense against visual-spoofing of the rendered `href`. The check covers only the raw UTF-8 forms of those code points: the percent-encoded forms (`%E2%80%AE` for U+202E, `%E2%81%A6` for U+2066, etc.) are not matched by the deny regex, survive `league/uri`'s parse/build cycle, and are re-emitted unchanged in the sanitized URL. Any downstream consumer that decodes the link before display — phishing-detection filters that compare `urldecode($href)` against a domain allow-list, audit-log dashboards that show a decoded form for readability, hover-tooltip previews, federated/syndicated content where the decoder lives on the consuming side — restores the BiDi character and the visual spoof that the original defense was filed to prevent.\n\nThe same `UrlSanitizer::parse()` carries an ASCII-only `/\\s/` whitespace check (no `/u` modifier) intended as a backstop against malformed URLs. Without the `/u` modifier, PCRE's `\\s` matches only ASCII whitespace, so Unicode whitespace characters — NBS","public_affected_ranges":["ECOSYSTEM: introduced 8.0.0; fixed 8.0.13"]},{"certainty":"source_listed","source_ids":["sr-c2acf9ef0aabe93198b0eae9251c000c"],"technology":"symfony/symfony","known_exclusions":[],"conditions_summary":"### Description\n\n`Symfony\\Component\\HtmlSanitizer\\TextSanitizer\\UrlSanitizer::parse()` rejects URLs containing raw Unicode explicit-direction BiDi formatting characters (U+202A–U+202E, U+2066–U+2069) as a defense against visual-spoofing of the rendered `href`. The check covers only the raw UTF-8 forms of those code points: the percent-encoded forms (`%E2%80%AE` for U+202E, `%E2%81%A6` for U+2066, etc.) are not matched by the deny regex, survive `league/uri`'s parse/build cycle, and are re-emitted unchanged in the sanitized URL. Any downstream consumer that decodes the link before display — phishing-detection filters that compare `urldecode($href)` against a domain allow-list, audit-log dashboards that show a decoded form for readability, hover-tooltip previews, federated/syndicated content where the decoder lives on the consuming side — restores the BiDi character and the visual spoof that the original defense was filed to prevent.\n\nThe same `UrlSanitizer::parse()` carries an ASCII-only `/\\s/` whitespace check (no `/u` modifier) intended as a backstop against malformed URLs. Without the `/u` modifier, PCRE's `\\s` matches only ASCII whitespace, so Unicode whitespace characters — NBS","public_affected_ranges":["ECOSYSTEM: introduced 6.1.0; fixed 6.4.41"]},{"certainty":"source_listed","source_ids":["sr-c2acf9ef0aabe93198b0eae9251c000c"],"technology":"symfony/symfony","known_exclusions":[],"conditions_summary":"### Description\n\n`Symfony\\Component\\HtmlSanitizer\\TextSanitizer\\UrlSanitizer::parse()` rejects URLs containing raw Unicode explicit-direction BiDi formatting characters (U+202A–U+202E, U+2066–U+2069) as a defense against visual-spoofing of the rendered `href`. The check covers only the raw UTF-8 forms of those code points: the percent-encoded forms (`%E2%80%AE` for U+202E, `%E2%81%A6` for U+2066, etc.) are not matched by the deny regex, survive `league/uri`'s parse/build cycle, and are re-emitted unchanged in the sanitized URL. Any downstream consumer that decodes the link before display — phishing-detection filters that compare `urldecode($href)` against a domain allow-list, audit-log dashboards that show a decoded form for readability, hover-tooltip previews, federated/syndicated content where the decoder lives on the consuming side — restores the BiDi character and the visual spoof that the original defense was filed to prevent.\n\nThe same `UrlSanitizer::parse()` carries an ASCII-only `/\\s/` whitespace check (no `/u` modifier) intended as a backstop against malformed URLs. Without the `/u` modifier, PCRE's `\\s` matches only ASCII whitespace, so Unicode whitespace characters — NBS","public_affected_ranges":["ECOSYSTEM: introduced 7.0.0; fixed 7.4.13"]},{"certainty":"source_listed","source_ids":["sr-c2acf9ef0aabe93198b0eae9251c000c"],"technology":"symfony/symfony","known_exclusions":[],"conditions_summary":"### Description\n\n`Symfony\\Component\\HtmlSanitizer\\TextSanitizer\\UrlSanitizer::parse()` rejects URLs containing raw Unicode explicit-direction BiDi formatting characters (U+202A–U+202E, U+2066–U+2069) as a defense against visual-spoofing of the rendered `href`. The check covers only the raw UTF-8 forms of those code points: the percent-encoded forms (`%E2%80%AE` for U+202E, `%E2%81%A6` for U+2066, etc.) are not matched by the deny regex, survive `league/uri`'s parse/build cycle, and are re-emitted unchanged in the sanitized URL. Any downstream consumer that decodes the link before display — phishing-detection filters that compare `urldecode($href)` against a domain allow-list, audit-log dashboards that show a decoded form for readability, hover-tooltip previews, federated/syndicated content where the decoder lives on the consuming side — restores the BiDi character and the visual spoof that the original defense was filed to prevent.\n\nThe same `UrlSanitizer::parse()` carries an ASCII-only `/\\s/` whitespace check (no `/u` modifier) intended as a backstop against malformed URLs. Without the `/u` modifier, PCRE's `\\s` matches only ASCII whitespace, so Unicode whitespace characters — NBS","public_affected_ranges":["ECOSYSTEM: introduced 8.0.0; fixed 8.0.13"]}],"null_published_at":"2026-10-31T22:27:09.615Z","source_updated_at":"2026-09-10T03:51:09.610Z","source_disclosed_at":"2026-06-15T17:32:59.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Dated EPSS estimate updated; this is not a new disclosure or proof of exploitation.","null_first_observed_at":"2026-10-31T21:42:41.369Z"},{"id":"NVI-00006791","kind":"vulnerability","title":"Symfony: HtmlSanitizer URL Parser Deny Gates Underinclusive: Percent-Encoded BiDi Marks and Unicode Whitespace Bypass Visual-Spoofing Defense","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-v3wm-qf9p-c549","CVE-2026-48760"],"plain_summary":"OSV carries this publisher advisory for symfony/html-sanitizer, symfony/html-sanitizer, symfony/html-sanitizer, symfony/symfony, symfony/symfony. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"The original advisory lists fixed boundaries 6.4.41 for symfony/html-sanitizer. Confirm the publisher’s latest guidance.","source_ids":["sr-c2acf9ef0aabe93198b0eae9251c000c"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 7.4.13 for symfony/html-sanitizer. Confirm the publisher’s latest guidance.","source_ids":["sr-c2acf9ef0aabe93198b0eae9251c000c"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 8.0.13 for symfony/html-sanitizer. Confirm the publisher’s latest guidance.","source_ids":["sr-c2acf9ef0aabe93198b0eae9251c000c"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 6.4.41 for symfony/symfony. Confirm the publisher’s latest guidance.","source_ids":["sr-c2acf9ef0aabe93198b0eae9251c000c"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 7.4.13 for symfony/symfony. Confirm the publisher’s latest guidance.","source_ids":["sr-c2acf9ef0aabe93198b0eae9251c000c"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 8.0.13 for symfony/symfony. Confirm the publisher’s latest guidance.","source_ids":["sr-c2acf9ef0aabe93198b0eae9251c000c"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-c2acf9ef0aabe93198b0eae9251c000c","url":"https://github.com/advisories/GHSA-v3wm-qf9p-c549","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-v3wm-qf9p-c549","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:42:41.369Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-c2acf9ef0aabe93198b0eae9251c000c"],"technology":"symfony/html-sanitizer","known_exclusions":[],"conditions_summary":"### Description\n\n`Symfony\\Component\\HtmlSanitizer\\TextSanitizer\\UrlSanitizer::parse()` rejects URLs containing raw Unicode explicit-direction BiDi formatting characters (U+202A–U+202E, U+2066–U+2069) as a defense against visual-spoofing of the rendered `href`. The check covers only the raw UTF-8 forms of those code points: the percent-encoded forms (`%E2%80%AE` for U+202E, `%E2%81%A6` for U+2066, etc.) are not matched by the deny regex, survive `league/uri`'s parse/build cycle, and are re-emitted unchanged in the sanitized URL. Any downstream consumer that decodes the link before display — phishing-detection filters that compare `urldecode($href)` against a domain allow-list, audit-log dashboards that show a decoded form for readability, hover-tooltip previews, federated/syndicated content where the decoder lives on the consuming side — restores the BiDi character and the visual spoof that the original defense was filed to prevent.\n\nThe same `UrlSanitizer::parse()` carries an ASCII-only `/\\s/` whitespace check (no `/u` modifier) intended as a backstop against malformed URLs. Without the `/u` modifier, PCRE's `\\s` matches only ASCII whitespace, so Unicode whitespace characters — NBS","public_affected_ranges":["ECOSYSTEM: introduced 6.1.0; fixed 6.4.41"]},{"certainty":"source_listed","source_ids":["sr-c2acf9ef0aabe93198b0eae9251c000c"],"technology":"symfony/html-sanitizer","known_exclusions":[],"conditions_summary":"### Description\n\n`Symfony\\Component\\HtmlSanitizer\\TextSanitizer\\UrlSanitizer::parse()` rejects URLs containing raw Unicode explicit-direction BiDi formatting characters (U+202A–U+202E, U+2066–U+2069) as a defense against visual-spoofing of the rendered `href`. The check covers only the raw UTF-8 forms of those code points: the percent-encoded forms (`%E2%80%AE` for U+202E, `%E2%81%A6` for U+2066, etc.) are not matched by the deny regex, survive `league/uri`'s parse/build cycle, and are re-emitted unchanged in the sanitized URL. Any downstream consumer that decodes the link before display — phishing-detection filters that compare `urldecode($href)` against a domain allow-list, audit-log dashboards that show a decoded form for readability, hover-tooltip previews, federated/syndicated content where the decoder lives on the consuming side — restores the BiDi character and the visual spoof that the original defense was filed to prevent.\n\nThe same `UrlSanitizer::parse()` carries an ASCII-only `/\\s/` whitespace check (no `/u` modifier) intended as a backstop against malformed URLs. Without the `/u` modifier, PCRE's `\\s` matches only ASCII whitespace, so Unicode whitespace characters — NBS","public_affected_ranges":["ECOSYSTEM: introduced 7.0.0; fixed 7.4.13"]},{"certainty":"source_listed","source_ids":["sr-c2acf9ef0aabe93198b0eae9251c000c"],"technology":"symfony/html-sanitizer","known_exclusions":[],"conditions_summary":"### Description\n\n`Symfony\\Component\\HtmlSanitizer\\TextSanitizer\\UrlSanitizer::parse()` rejects URLs containing raw Unicode explicit-direction BiDi formatting characters (U+202A–U+202E, U+2066–U+2069) as a defense against visual-spoofing of the rendered `href`. The check covers only the raw UTF-8 forms of those code points: the percent-encoded forms (`%E2%80%AE` for U+202E, `%E2%81%A6` for U+2066, etc.) are not matched by the deny regex, survive `league/uri`'s parse/build cycle, and are re-emitted unchanged in the sanitized URL. Any downstream consumer that decodes the link before display — phishing-detection filters that compare `urldecode($href)` against a domain allow-list, audit-log dashboards that show a decoded form for readability, hover-tooltip previews, federated/syndicated content where the decoder lives on the consuming side — restores the BiDi character and the visual spoof that the original defense was filed to prevent.\n\nThe same `UrlSanitizer::parse()` carries an ASCII-only `/\\s/` whitespace check (no `/u` modifier) intended as a backstop against malformed URLs. Without the `/u` modifier, PCRE's `\\s` matches only ASCII whitespace, so Unicode whitespace characters — NBS","public_affected_ranges":["ECOSYSTEM: introduced 8.0.0; fixed 8.0.13"]},{"certainty":"source_listed","source_ids":["sr-c2acf9ef0aabe93198b0eae9251c000c"],"technology":"symfony/symfony","known_exclusions":[],"conditions_summary":"### Description\n\n`Symfony\\Component\\HtmlSanitizer\\TextSanitizer\\UrlSanitizer::parse()` rejects URLs containing raw Unicode explicit-direction BiDi formatting characters (U+202A–U+202E, U+2066–U+2069) as a defense against visual-spoofing of the rendered `href`. The check covers only the raw UTF-8 forms of those code points: the percent-encoded forms (`%E2%80%AE` for U+202E, `%E2%81%A6` for U+2066, etc.) are not matched by the deny regex, survive `league/uri`'s parse/build cycle, and are re-emitted unchanged in the sanitized URL. Any downstream consumer that decodes the link before display — phishing-detection filters that compare `urldecode($href)` against a domain allow-list, audit-log dashboards that show a decoded form for readability, hover-tooltip previews, federated/syndicated content where the decoder lives on the consuming side — restores the BiDi character and the visual spoof that the original defense was filed to prevent.\n\nThe same `UrlSanitizer::parse()` carries an ASCII-only `/\\s/` whitespace check (no `/u` modifier) intended as a backstop against malformed URLs. Without the `/u` modifier, PCRE's `\\s` matches only ASCII whitespace, so Unicode whitespace characters — NBS","public_affected_ranges":["ECOSYSTEM: introduced 6.1.0; fixed 6.4.41"]},{"certainty":"source_listed","source_ids":["sr-c2acf9ef0aabe93198b0eae9251c000c"],"technology":"symfony/symfony","known_exclusions":[],"conditions_summary":"### Description\n\n`Symfony\\Component\\HtmlSanitizer\\TextSanitizer\\UrlSanitizer::parse()` rejects URLs containing raw Unicode explicit-direction BiDi formatting characters (U+202A–U+202E, U+2066–U+2069) as a defense against visual-spoofing of the rendered `href`. The check covers only the raw UTF-8 forms of those code points: the percent-encoded forms (`%E2%80%AE` for U+202E, `%E2%81%A6` for U+2066, etc.) are not matched by the deny regex, survive `league/uri`'s parse/build cycle, and are re-emitted unchanged in the sanitized URL. Any downstream consumer that decodes the link before display — phishing-detection filters that compare `urldecode($href)` against a domain allow-list, audit-log dashboards that show a decoded form for readability, hover-tooltip previews, federated/syndicated content where the decoder lives on the consuming side — restores the BiDi character and the visual spoof that the original defense was filed to prevent.\n\nThe same `UrlSanitizer::parse()` carries an ASCII-only `/\\s/` whitespace check (no `/u` modifier) intended as a backstop against malformed URLs. Without the `/u` modifier, PCRE's `\\s` matches only ASCII whitespace, so Unicode whitespace characters — NBS","public_affected_ranges":["ECOSYSTEM: introduced 7.0.0; fixed 7.4.13"]},{"certainty":"source_listed","source_ids":["sr-c2acf9ef0aabe93198b0eae9251c000c"],"technology":"symfony/symfony","known_exclusions":[],"conditions_summary":"### Description\n\n`Symfony\\Component\\HtmlSanitizer\\TextSanitizer\\UrlSanitizer::parse()` rejects URLs containing raw Unicode explicit-direction BiDi formatting characters (U+202A–U+202E, U+2066–U+2069) as a defense against visual-spoofing of the rendered `href`. The check covers only the raw UTF-8 forms of those code points: the percent-encoded forms (`%E2%80%AE` for U+202E, `%E2%81%A6` for U+2066, etc.) are not matched by the deny regex, survive `league/uri`'s parse/build cycle, and are re-emitted unchanged in the sanitized URL. Any downstream consumer that decodes the link before display — phishing-detection filters that compare `urldecode($href)` against a domain allow-list, audit-log dashboards that show a decoded form for readability, hover-tooltip previews, federated/syndicated content where the decoder lives on the consuming side — restores the BiDi character and the visual spoof that the original defense was filed to prevent.\n\nThe same `UrlSanitizer::parse()` carries an ASCII-only `/\\s/` whitespace check (no `/u` modifier) intended as a backstop against malformed URLs. Without the `/u` modifier, PCRE's `\\s` matches only ASCII whitespace, so Unicode whitespace characters — NBS","public_affected_ranges":["ECOSYSTEM: introduced 8.0.0; fixed 8.0.13"]}],"null_published_at":"2026-10-31T22:13:10.085Z","source_updated_at":"2026-09-10T03:51:09.610Z","source_disclosed_at":"2026-06-15T17:32:59.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T21:42:41.369Z"}],"next_cursor":null,"snapshot_revision":"42594"}