CVE-2026-45066

CVE-2026-45066 affects Symfony’s HtmlSanitizer: URL sanitization bypass due to UrlSanitizer::parse() following RFC 3986 while browsers use WHATWG, and because is checked against the media policy instead of the link policy. Affected versions: 6.1.0-BETA1–6.4.40, 7.4.12, and 8.0.12. Impact: off-al...