CVE-2025-47946 Information

Description

Symfony UX is an initiative and set of libraries to integrate JavaScript tools into applications. Prior to version 2.25.1 rendering attributes or using any method that returns a ComponentAttributes instance (e.g. only() defaults() without()) ouputs attribute values directly without escaping. If these values are unsafe (e.g. contain user input) this can lead to HTML attribute injection and XSS vulnerabilities. The issue is fixed in version 2.25.1 of symfony/ux-twig-component Those who use symfony/ux-live-component must also update it to 2.25.1 to benefit from the fix as it reuses the ComponentAttributes class internally. As a workaround avoid rendering attributes or derived objects directly if it may contain untrusted values. Instead use attributes.render('name') for safe output of individual attributes.

Reference

https://github.com/symfony/ux/commit/b5d1c85995c128cb926d47a96cfbfbd500b643a8 https://github.com/symfony/ux/security/advisories/GHSA-5j3w-5pcr-f8hg