CVE-2025-47946 json
symfony/ux-live-component and symfony/ux-twig-component vulnerable to unsanitized HTML attribute injection via ComponentAttributes
published 2025-05-19 17 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-15795 , GHSA-5j3w-5pcr-f8hg
- cvss
- 6.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 16%
- public exploits
- 0
- none known
Summary
Symfony UX is an initiative and set of libraries to integrate JavaScript tools into applications. Prior to version 2.25.1, rendering `{{ attributes }}` or using any method that returns a `ComponentAttributes` instance (e.g. `only()`, `defaults()`, `without()`) ouputs attribute values directly without escaping. If these values are unsafe (e.g. contain user input), this can lead to HTML attribute injection and XSS vulnerabilities. The issue is fixed in version `2.25.1` of `symfony/ux-twig-component` Those who use `symfony/ux-live-component` must also update it to `2.25.1` to benefit from the fix, as it reuses the `ComponentAttributes` class internally. As a workaround, avoid rendering `{{ attributes }}` or derived objects directly if it may contain untrusted values. Instead, use `{{ attributes.render('name') }}` for safe output of individual attributes.
Patch / fix
- packagist symfony/ux-twig-component 2.25.1
- packagist symfony/ux-live-component 2.25.1
- symfony ux 2.25.1
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 17 mo ago
Exploit prediction
0.25% chance of exploitation in the next 30 days, higher than 16% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| GitHub | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | symfony/ux-twig-component | <2.25.1 |
2.25.1 |
| packagist | symfony/ux-live-component | <2.25.1 |
2.25.1 |
Affected products
- symfony ux
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
github.com
/symfony/ux/commit/b5d1c85995c128cb926d47a96cfbfbd500b643a8
web
-
github.com
/symfony/ux-live-component/commit/7ad44cf56d750b9f56658ed986286a10da132ee7
web
-
github.com
/symfony/ux-twig-component/commit/b5d4e77db69315aeb18d2238e0e7c943d340ce76
web
-
github.com
/symfony/ux/commit/c2f7738ee0969c31df7514025a7f5fc6e153932d
web
-
github.com
/symfony/ux/security/advisories/GHSA-5j3w-5pcr-f8hg
web
-
nvd.nist.gov
/vuln/detail/CVE-2025-47946
advisory
-
github.com
/FriendsOfPHP/security-advisories/blob/master/symfony/ux-live-component/CVE-2025-47946.yaml
web
-
github.com
/FriendsOfPHP/security-advisories/blob/master/symfony/ux-twig-component/CVE-2025-47946.yaml
web
-
github.com
/symfony/ux
package
-
symfony.com
/blog/symfony-ux-cve-2025-47946-unsanitized-html-attribute-injection-via-componentattributes
web
Sources
- CVE List CVE-2025-47946
- GitHub Advisory GHSA-5j3w-5pcr-f8hg
- NVD CVE-2025-47946
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.