Threats affecting pkg:composer/symfony/html-sanitizer

CVE-2026-121373 is a vulnerability in the Symfony HtmlSanitizer component affecting versions 6.1.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11. The MetaRefreshAttributeSanitizer uses an overly restrictive regular expression to sanitize the refresh URL in meta tags, which can be bypassed. This allows an attacker to craft meta refresh tags that redirect users to untrusted sites, bypassing URL sanitization controls. The issue arises because the regular expression does not fully conform to the WHATWG HTML Standard for meta refresh directives, missing cases where the separator after the time is ASCII whitespace and the url= keyword is optional. The vulnerability is reachable under any configuration that allows meta tags with http-equiv and content attributes, including the allowStaticElements() preset.