Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Packagist package

symfony/ux-twig-component

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 6.1PackagistPublished

    Symfony UX allows unsanitized HTML attribute injection via ComponentAttributes

    CVE-2025-47946 · GHSA-5j3w-5pcr-f8hg

    Affected
    • Packagist symfony/ux-twig-component < 2.25.1
    Fixed in
    2.25.1· Vendor fix available
    Issue
    Impact Rendering {{ attributes }} or using any method that returns a ComponentAttributes instance (e.g. only(), defaults(), without()) ouputs attribute values directly without escaping. If these values are unsafe (e.g. contain user input), this can lead to HTML attribute injection and XSS vulnerabilities. Patches The issue is fixed in version 2.25.1 of symfony/ux-twig-component by using Twig's EscaperRuntime to properly escape HTML attributes in ComponentAttributes. If you use symfony/ux-live-component, you must also update it to 2.25.1 to benefit from the fix, as it reuses the ComponentAttributes class internally. Workarounds Until you can upgrade, avoid rendering {{ attributes }} or derived objects directly if it may contain untrusted values. Instead, use {{ attributes.render('name') }} for safe output of individual attributes. References GitHub repository: symfony/ux

    Recommended action: Upgrade to 2.25.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →