Spoofing attack in Symfony - CVE-2026-45064

Detailed vulnerability description

The vulnerability allows a remote attacker to spoof the visual destination of a link.

The vulnerability exists due to user interface misrepresentation of critical information in Symfony\Component\HtmlSanitizer\TextSanitizer\UrlSanitizer::parse() when sanitizing URLs for href or src attributes. A remote attacker can supply a crafted URL containing bidirectional override characters to spoof the visual destination of a link.

When rendered in a browser, Unicode explicit-direction BiDi formatting characters can alter the visual ordering of the displayed URL text, causing sanitized content to present a link that appears different from its actual destination.

How to mitigate CVE-2026-45064

Sources

• https://github.com/symfony/symfony/security/advisories/GHSA-h5vq-qfcg-4m6p
• https://github.com/symfony/symfony/commit/743a435e948b897ef2b5564ac438d4beb95d2526