CVE-2026-121373
Received Received - Intake

Meta Refresh Bypass in Symfony HtmlSanitizer

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: Checkmarx

Description
The Symfony HtmlSanitizer component MetaRefreshAttributeSanitizer, introduced to fix CVE-2026-48761, sanitizes the refresh URL of content attributes of meta tags using a regular expression that is too narrow, allowing sanitization to be bypassed, and resulting in potential URL redirection to untrusted sites in Symfony versions 6.1.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11. The shared declarative refresh steps in the WHATWG HTML Standard require a broader approach: the separator after the time may be ASCII whitespace alone, with no ; or ,, and the url= keyword is optional. Directives the browser honours, but the regular expression misses are returned unchanged, so the attacker URL skips UrlSanitizer entirely and both allowLinkSchemes and allowLinkHosts are defeated for the refresh navigation. This is reachable under any configuration that allows meta with http-equiv and content, including the documented allowStaticElements() preset.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-04
Last Modified
2026-11-04
Generated
2026-11-04
AI Q&A
2026-11-04
EPSS Evaluated
N/A
NVD
CVE-2026-121373
EUVD
EUVD-2026-116909

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
sensiolabs symfony 6.1
sensiolabs symfony 7
sensiolabs symfony 8

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-601 The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.
CWE-186 A regular expression is overly restrictive, which prevents dangerous values from being detected.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-121373 is a security bypass in Symfony's HtmlSanitizer component, specifically in the MetaRefreshAttributeSanitizer. It involves an incomplete fix for CVE-2026-48761 where the sanitizer's regular expression was too narrow. This allowed malicious URLs in meta tags to bypass security checks and redirect users to untrusted sites.

Detection Guidance

To detect this vulnerability, inspect Symfony applications using versions 6.1.x prior to 6.4.50, 7.x prior to 7.4.23, or 8.x prior to 8.1.11. Check for meta tags with http-equiv='refresh' and content attributes containing URLs. Use commands like grep to search for such patterns in your codebase or logs.

Impact Analysis

This vulnerability could allow attackers to redirect users to malicious websites by exploiting improperly sanitized meta tags. It bypasses URL sanitization and restrictions on link schemes and hosts, potentially leading to phishing attacks or malware downloads.

Compliance Impact

This vulnerability could potentially affect compliance with GDPR and HIPAA by enabling malicious URL redirections through bypassed sanitization in meta tags. Attackers could exploit this to redirect users to untrusted sites, risking data exposure or unauthorized access, which may violate data protection requirements under these regulations.

Mitigation Strategies

Immediately update Symfony to versions 6.4.50 or later, 7.4.23 or later, or 8.1.11 or later. If updating is not possible, review and sanitize all meta tags with http-equiv='refresh' manually. Remove or restrict any untrusted content that could bypass sanitization.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-121373. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...