The Symfony PHP framework contains a vulnerability in the UrlAttributeSanitizer::getSupportedAttributes() method that causes it to omit URL-valued attributes including action, formaction, poster, and cite. This omission allows configurations that permit these attributes to leave javascript: URIs unsanitized, which can lead to cross-site scripting (XSS) attacks when the resulting HTML is rendered or when a victim submits a form or clicks a button. The vulnerability affects Symfony versions from 6.1.0-BETA1 until versions fixed in 6.4.40, 7.4.12, and 8.0.12. The issue has been addressed in these fixed versions. Multiple Ubuntu package versions of Symfony are affected as listed. There are no known exploits in the wild at this time.

This vulnerability can enable cross-site scripting (XSS) attacks by allowing javascript: URIs to bypass sanitization in certain URL-valued attributes. Successful exploitation could lead to execution of arbitrary JavaScript in the context of the affected web application, potentially compromising user data or session integrity. The vulnerability requires user interaction (UI:A) and partial attack complexity (AC:L). No privileges or user authentication are required to exploit (PR:N).

A fix is available in Symfony versions 6.4.40, 7.4.12, and 8.0.12. Users and administrators should upgrade to these fixed versions to remediate the vulnerability. The affected Ubuntu package versions should be updated accordingly when patches are released. No vendor advisory content was provided to indicate alternative mitigations or if the issue is already mitigated in specific environments.