CVE-2025-47946: symfony/ux-live-component and symfony/ux-twig-component vulnerable to unsanitized HTML attribute injection via ComponentAttributes
Description
Symfony UX is an initiative and set of libraries to integrate JavaScript tools into applications. Prior to version 2.25.1, rendering `{{ attributes }}` or using any method that returns a `ComponentAttributes` instance (e.g. `only()`, `defaults()`, `without()`) ouputs attribute values directly without escaping. If these values are unsafe (e.g. contain user input), this can lead to HTML attribute injection and XSS vulnerabilities. The issue is fixed in version `2.25.1` of `symfony/ux-twig-component` Those who use `symfony/ux-live-component` must also update it to `2.25.1` to benefit from the fix, as it reuses the `ComponentAttributes` class internally. As a workaround, avoid rendering `{{ attributes }}` or derived objects directly if it may contain untrusted values.
Instead, use `{{ attributes.render('name') }}` for safe output of individual attributes.
Classification
CVE ID: CVE-2025-47946
CVSS Base Severity: MEDIUM
CVSS Base Score: 6.1
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Problem Types
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')Affected Products
Vendor: symfony
Product: ux
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.03% (probability of being exploited)
EPSS Percentile: 7.16% (scored less or equal to compared to others)
EPSS Date: 2025-06-17 (when was this score calculated)
References
https://nvd.nist.gov/vuln/detail/CVE-2025-47946https://github.com/symfony/ux/security/advisories/GHSA-5j3w-5pcr-f8hg
https://github.com/symfony/ux/commit/b5d1c85995c128cb926d47a96cfbfbd500b643a8