Symfony UX allows unsanitized HTML attribute injection via ComponentAttributes
The advisory, in context
Impact
Rendering {{ attributes }} or using any method that returns a ComponentAttributes instance (e.g. only(), defaults(), without()) ouputs attribute values directly without escaping. If these values are unsafe (e.g. contain user input), this can lead to HTML attribute injection and XSS vulnerabilities.
Patches
The issue is fixed in version 2.25.1 of symfony/ux-twig-component by using Twig's EscaperRuntime to properly escape HTML attributes in ComponentAttributes. If you use symfony/ux-live-component, you must also update it to 2.25.1 to benefit from the fix, as it reuses the ComponentAttributes class internally.
Workarounds
Until you can upgrade, avoid rendering {{ attributes }} or derived objects directly if it may contain untrusted values.
Instead, use {{ attributes.render('name') }} for safe output of individual attributes.
References
GitHub repository: symfony/ux
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
Earlier releases before 2.25.1
Fixed in 2.25.1
41 explicitly affected versions
v2.0.0, v2.0.1, v2.1.0, v2.1.1, v2.10.0, v2.11.0, v2.11.1, v2.11.2, v2.12.0, v2.13.0, v2.13.1, v2.13.3, v2.14.0, v2.14.2, v2.15.0, v2.16.0, v2.17.0, v2.18.0, v2.18.1, v2.19.0, v2.19.2, v2.2.0, v2.20.0, v2.21.0, v2.22.0, v2.22.1, v2.23.0, v2.24.0, v2.25.0, v2.3.0, v2.4.0, v2.5.0, v2.6.0, v2.6.1, v2.7.0, v2.7.1, v2.8.0, v2.8.1, v2.9.0, v2.9.1, v2.9.2
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.25.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v2.0.0",
"v2.0.1",
"v2.1.0",
"v2.1.1",
"v2.10.0",
"v2.11.0",
"v2.11.1",
"v2.11.2",
"v2.12.0",
"v2.13.0",
"v2.13.1",
"v2.13.3",
"v2.14.0",
"v2.14.2",
"v2.15.0",
"v2.16.0",
"v2.17.0",
"v2.18.0",
"v2.18.1",
"v2.19.0",
"v2.19.2",
"v2.2.0",
"v2.20.0",
"v2.21.0",
"v2.22.0",
"v2.22.1",
"v2.23.0",
"v2.24.0",
"v2.25.0",
"v2.3.0",
"v2.4.0",
"v2.5.0",
"v2.6.0",
"v2.6.1",
"v2.7.0",
"v2.7.1",
"v2.8.0",
"v2.8.1",
"v2.9.0",
"v2.9.1",
"v2.9.2"
]
}Earlier releases before 2.25.1
Fixed in 2.25.1
42 explicitly affected versions
v2.0.0, v2.0.1, v2.1.0, v2.1.1, v2.10.0, v2.11.0, v2.11.1, v2.11.2, v2.12.0, v2.13.0, v2.13.1, v2.13.2, v2.13.3, v2.14.0, v2.14.1, v2.14.2, v2.15.0, v2.16.0, v2.17.0, v2.18.0, v2.18.1, v2.19.0, v2.19.2, v2.2.0, v2.20.0, v2.21.0, v2.22.0, v2.22.1, v2.23.0, v2.24.0, v2.25.0, v2.3.0, v2.4.0, v2.5.0, v2.6.0, v2.6.1, v2.7.0, v2.7.1, v2.8.0, v2.8.1, v2.9.0, v2.9.1
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.25.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v2.0.0",
"v2.0.1",
"v2.1.0",
"v2.1.1",
"v2.10.0",
"v2.11.0",
"v2.11.1",
"v2.11.2",
"v2.12.0",
"v2.13.0",
"v2.13.1",
"v2.13.2",
"v2.13.3",
"v2.14.0",
"v2.14.1",
"v2.14.2",
"v2.15.0",
"v2.16.0",
"v2.17.0",
"v2.18.0",
"v2.18.1",
"v2.19.0",
"v2.19.2",
"v2.2.0",
"v2.20.0",
"v2.21.0",
"v2.22.0",
"v2.22.1",
"v2.23.0",
"v2.24.0",
"v2.25.0",
"v2.3.0",
"v2.4.0",
"v2.5.0",
"v2.6.0",
"v2.6.1",
"v2.7.0",
"v2.7.1",
"v2.8.0",
"v2.8.1",
"v2.9.0",
"v2.9.1"
]
}References
- https://github.com/symfony/ux/security/advisories/GHSA-5j3w-5pcr-f8hg
- https://nvd.nist.gov/vuln/detail/CVE-2025-47946
- https://github.com/symfony/ux-live-component/commit/7ad44cf56d750b9f56658ed986286a10da132ee7
- https://github.com/symfony/ux-twig-component/commit/b5d4e77db69315aeb18d2238e0e7c943d340ce76
- https://github.com/symfony/ux/commit/b5d1c85995c128cb926d47a96cfbfbd500b643a8
- https://github.com/symfony/ux/commit/c2f7738ee0969c31df7514025a7f5fc6e153932d
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/ux-live-component/CVE-2025-47946.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/ux-twig-component/CVE-2025-47946.yaml
- https://github.com/symfony/ux
- https://symfony.com/blog/symfony-ux-cve-2025-47946-unsanitized-html-attribute-injection-via-componentattributes