Symfony UX allows unsanitized HTML attribute injection via ComponentAttributes
Impact
Rendering {{ attributes }} or using any method that returns a ComponentAttributes instance (e.g. only(), defaults(), without()) ouputs attribute values directly without escaping. If these values are unsafe (e.g. contain user input), this can lead to HTML attribute injection and XSS vulnerabilities.
Patches
The issue is fixed in version 2.25.1 of symfony/ux-twig-component by using Twig's EscaperRuntime to properly escape HTML attributes in ComponentAttributes. If you use symfony/ux-live-component, you must also update it to 2.25.1 to benefit from the fix, as it reuses the ComponentAttributes class internally.
Workarounds
Until you can upgrade, avoid rendering {{ attributes }} or derived objects directly if it may contain untrusted values.
Instead, use {{ attributes.render('name') }} for safe output of individual attributes.
References
GitHub repository: symfony/ux
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Composer package | symfony/ux-live-component | < 2.25.1 | 2.25.1 |
| Composer package | symfony/ux-twig-component | < 2.25.1 | 2.25.1 |
References
- https://github.com/symfony/ux/security/advisories/GHSA-5j3w-5pcr-f8hg
- https://nvd.nist.gov/vuln/detail/CVE-2025-47946
- https://github.com/symfony/ux-live-component/commit/7ad44cf56d750b9f56658ed986286a10da132ee7
- https://github.com/symfony/ux-twig-component/commit/b5d4e77db69315aeb18d2238e0e7c943d340ce76
- https://github.com/symfony/ux/commit/b5d1c85995c128cb926d47a96cfbfbd500b643a8
- https://github.com/symfony/ux/commit/c2f7738ee0969c31df7514025a7f5fc6e153932d
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/ux-live-component/CVE-2025-47946.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/ux-twig-component/CVE-2025-47946.yaml
- https://github.com/symfony/ux
- https://symfony.com/blog/symfony-ux-cve-2025-47946-unsanitized-html-attribute-injection-via-componentattributes
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N- Weakness (CWE)
CWE-79- Platform
- Composer
- Package
symfony/ux-live-component, symfony/ux-twig-component- Disclosed
- 19.05.2025
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-5j3w-5pcr-f8hg - CC BY 4.0
Vulnerability history: symfony/ux-live-component
All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 6
- First → latest
- 05.2025 06.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Medium 3
- Low 3
Disclosures per year
- 2025: 1
- 2026: 5
-
Symfony UX allows unsanitized HTML attribute injection via ComponentAttributes this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.