CyberRota Analysis
AI-GeneratedThe ux_icon() Twig function in Symfony UX versions prior to 2.36.1 and 3.2.0 is vulnerable to cross-site scripting (XSS) due to the inlining of unsanitized SVG sources, which can execute malicious scripts. This vulnerability primarily affects developers using these versions of Symfony who may inadvertently expose their applications to XSS attacks through local SVG files or unsafe JSON responses. Organizations utilizing affected versions should prioritize upgrading to the patched releases to mitigate potential security risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Symfony UX is a JavaScript ecosystem for Symfony. From 2.17.0 before 2.36.1 and from 3.0.0 before 3.2.0, the ux_icon() Twig function is marked is_safe=['html'] and Icon::toHtml() inlines SVG source verbatim, allowing unsanitized local SVG files or Iconify on-demand JSON body responses containing nested script elements, on* event handlers, or dangerous URL schemes to execute cross-site scripting. This issue is fixed in versions 2.36.1 and 3.2.0.