CVE-2025-47946
Symfony UX is an initiative and set of libraries to integrate JavaScript tools into applications. Prior to version 2.25.1, rendering {{ attributes }} or using any method that returns a ComponentAttributes instance (e.g. only(), defaults(), without()) ouputs attribute values directly without escaping. If these values are unsafe (e.g. contain user input), this can lead to HTML attribute injection and XSS vulnerabilities. The issue is fixed in version 2.25.1 of symfony/ux-twig-component Those who use symfony/ux-live-component must also update it to 2.25.1 to benefit from the fix, as it reuses the ComponentAttributes class internally. As a workaround, avoid rendering {{ attributes }} or derived objects directly if it may contain untrusted values.
Instead, use {{ attributes.render('name') }} for safe output of individual attributes.
| Software | From | Fixed in |
|---|---|---|
symfony / ux-twig-component
|
- | 2.25.1 |
|
symfony / ux-live-component
|
- | 2.25.1 |
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/ux-live-component/CVE-2025-47946.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/ux-twig-component/CVE-2025-47946.yaml
- https://github.com/symfony/ux-live-component/commit/7ad44cf56d750b9f56658ed986286a10da132ee7
- https://github.com/symfony/ux-twig-component/commit/b5d4e77db69315aeb18d2238e0e7c943d340ce76
- https://github.com/symfony/ux/commit/b5d1c85995c128cb926d47a96cfbfbd500b643a8
- https://github.com/symfony/ux/commit/c2f7738ee0969c31df7514025a7f5fc6e153932d
- https://github.com/symfony/ux/security/advisories/GHSA-5j3w-5pcr-f8hg
- https://symfony.com/blog/symfony-ux-cve-2025-47946-unsanitized-html-attribute-injection-via-componentattributes
Deep Security Visibility Without the Complexity
SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.
- No setup fees
- 5-min deployment
- Cancel anytime