CVE-2025-47946: symfony/ux-live-component and symfony/ux-twig-component vulnerable to unsanitized HTML attribute injection via ComponentAttributes
Impact
Rendering {{ attributes }} or using any method that returns a ComponentAttributes instance (e.g. only(), defaults(), without()) ouputs attribute values directly without escaping. If these values are unsafe (e.g. contain user input), this can lead to HTML attribute injection and XSS vulnerabilities.
Patches
The issue is fixed in version 2.25.1 of symfony/ux-twig-component by using Twig's EscaperRuntime to properly escape HTML attributes in ComponentAttributes. If you use symfony/ux-live-component, you must also update it to 2.25.1 to benefit from the fix, as it reuses the ComponentAttributes class internally.
Workarounds
Until you can upgrade, avoid rendering {{ attributes }} or derived objects directly if it may contain untrusted values. Instead, use {{ attributes.render('name') }} for safe output of individual attributes.
References
GitHub repository: symfony/ux
Other sources
Symfony UX is an initiative and set of libraries to integrate JavaScript tools into applications. Prior to version 2.25.1, rendering {{ attributes }} or using any method that returns a ComponentAttributes instance (e.g. only(), defaults(), without()) ouputs attribute values directly without escaping. If these values are unsafe (e.g. contain user input), this can lead to HTML attribute injection and XSS vulnerabilities. The issue is fixed in version 2.25.1 of symfony/ux-twig-component Those who use symfony/ux-live-component must also update it to 2.25.1 to benefit from the fix, as it reuses the ComponentAttributes class internally. As a workaround, avoid rendering {{ attributes }} or derived objects directly if it may contain untrusted values. Instead, use {{ attributes.render('name') }} for safe output of individual attributes.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-47946?
CVE-2025-47946 is classified as a medium severity vulnerability.
How do I fix CVE-2025-47946?
To mitigate CVE-2025-47946, upgrade to Symfony ux-twig-component and ux-live-component version 2.25.1 or later.
What components are affected by CVE-2025-47946?
CVE-2025-47946 affects Symfony ux-twig-component and ux-live-component versions prior to 2.25.1.
What kind of issue does CVE-2025-47946 represent?
CVE-2025-47946 represents an attribute value output vulnerability in Symfony's JavaScript integration libraries.
Is there a known exploit for CVE-2025-47946?
As of now, there are no publicly known exploits for CVE-2025-47946.