CVE-2026-121949

A flaw was found in symfony/html-sanitizer. The HTML sanitizer fails to enforce configured media host and URL scheme restrictions on srcset and imagesrcset attributes. A remote attacker could exploit this vulnerability by submitting crafted HTML with image sources pointing to unauthorized domains...