Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0-BETA1 until 6.4.40, 7.4.12, and 8.0.12, UrlAttributeSanitizer::getSupportedAttributes() omits URL-valued attributes including action, formaction, poster, and cite, so configurations that admit those attributes can leave javascript: URIs unsanitized and enable XSS when the resulting HTML is rendered or a victim submits a form or clicks a button. This issue is fixed in versions 6.4.40, 7.4.12, and 8.0.12.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From
    6.1.0-BETA1 until 6.4.40, 7.4.12, and 8.0.12, UrlAttributeSanitizer::getSupportedAttributes() omits URL-
    valued attributes including action, formaction, poster, and cite, so configurations that admit those
    attributes can leave javascript: URIs unsanitized and enable XSS when the resulting HTML is rendered or a
    victim submits a form or clicks a button. This issue is fixed in versions 6.4.40, 7.4.12, and 8.0.12.
    (CVE-2026-45753)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From     6.1.0-BETA1 until 6.4.40, 7.4.12, and 8.0.12, UrlAttributeSanitizer::getSupportedAttributes() omits URL-     valued attributes including action, formaction, poster, and cite, so configurations that admit those     attributes can leave javascript: URIs unsanitized and enable XSS when the resulting HTML is rendered or a     victim submits a form or clicks a button. This issue is fixed in versions 6.4.40, 7.4.12, and 8.0.12.
    (CVE-2026-45753)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
442435	SCA: security update for symfony/html-sanitizer, symfony/symfony (GHSA-hhg7-c65m-h7ff)	Tenable Cloud Security	SCA Checks	Local	low
442435	SCA: security update for symfony/html-sanitizer, symfony/symfony (GHSA-hhg7-c65m-h7ff)	Tenable Self-Hosted Container Security	SCA Checks	Local	low
316418	Linux Distros Unpatched Vulnerability : CVE-2026-45753	Nessus	Misc.	Local	low

Detections

Analytics

CVE-2026-45753

low

Tenable Plugins

low

low

low