Symfony UX security advisories

All Symfony UX advisories

11 advisories, newest first.

• high Symfony · Jun 19, 2026 · Reviewed Nov 4

  Symfony UX Toolkit: Malicious Kit Can Read and Write Any File

  Lets a crafted or compromised recipe kit read or overwrite files outside the project when you run ux:install, which can lead to running code.

  Fixed in 3.2.0 and 2.36.1

• medium Symfony · Jun 19, 2026 · Reviewed Nov 4

  Symfony UX Icons: Malicious SVG Icons Can Run Scripts in the Page

  Lets a malicious icon file or Iconify endpoint run script in visitors' browsers in apps that render icons with ux_icon().

  Fixed in 3.2.0 and 2.36.1

• medium Symfony · May 29, 2026 · Reviewed Nov 2

  Symfony UX Live Component: Date Props Accept Relative Dates

  Lets a client move a writable date prop to any point in time, getting past date-based checks in live components.

  Fixed in 3.1.0 and 2.36.0

• low Symfony · May 29, 2026 · Reviewed Nov 2

  Symfony UX Live Component: Large Batch Requests Can Overload the Server

  Lets a logged-in user tie up CPU, memory and database connections by sending one batch request with thousands of live actions.

  Fixed in 3.1.0 and 2.36.0

• low Symfony · May 29, 2026 · Reviewed Nov 2

  Symfony UX Live Component: LiveAction CSRF Check Can Be Bypassed

  Lets another site trigger live actions in a user's session, in apps whose session cookies use SameSite=None.

  Fixed in 3.1.0 and 2.36.0

• medium Symfony · May 29, 2026 · Reviewed Nov 2

  Symfony UX Live Component: Cross-Site Scripting via Child Component Tag

  Lets an attacker inject HTML into a live component re-render, mainly in apps that have relaxed CORS for the live component endpoint.

  Fixed in 3.1.0 and 2.36.0

• low Symfony · May 29, 2026 · Reviewed Nov 2

  Symfony UX Live Component: Signed Props Can Be Reused Across Components

  Lets a client reuse signed read-only props from one live component in another whose prop names match, changing state it shouldn't.

  Fixed in 3.1.0 and 2.36.0

• medium Symfony · May 29, 2026 · Reviewed Nov 2

  Symfony UX Autocomplete: Stored Cross-Site Scripting in Dropdown Results

  Lets an attacker run script in other users' browsers when autocomplete results come from content users can write.

  Fixed in 3.1.0 and 2.36.0

• medium Symfony · May 29, 2026 · Reviewed Nov 2

  Symfony UX Autocomplete: Wildcards Expose Unlisted Entity Data

  Lets anyone probe every column of an entity through a public autocomplete endpoint by sending search wildcards.

  Fixed in 3.1.0 and 2.36.0

• medium Symfony · May 19, 2025 · Reviewed Nov 8

  Symfony UX Twig Components: Unescaped Attributes Allow XSS

  Lets an attacker inject HTML and script into pages that render component attributes holding user input with {{ attributes }}.

  Fixed in 2.25.1

• medium Symfony · Sep 11, 2023

  symfony/ux-autocomplete Prevent injection of invalid entity ids for "autocomplete" fields

  Fixed in 2.11.2