Security: symfony/ux
Security Advisories
View information about security vulnerabilities from this repository's maintainers.
-
Path Traversal in symfony/ux-toolkit Allows Arbitrary File Write and Read via Crafted Recipe ManifestGHSA-p9xj-fpr2-jf2q published
Jun 19, 2026 by fabpotHigh -
XSS in symfony/ux-icons via unsanitized SVG content in local files and Iconify on-demand responsesGHSA-6v8j-33hc-mv84 published
Jun 19, 2026 by fabpotModerate -
Format-less date LiveProps parsed with the permissive DateTime constructorGHSA-89g7-22c8-3j23 published
May 29, 2026 by nicolas-grekasLow -
Denial of service in symfony/ux-live-component via unbounded batch action requestsGHSA-mm82-c99c-h2cf published
May 29, 2026 by nicolas-grekasLow -
XSS in symfony/ux-live-component via attacker-controlled child component tagGHSA-38x5-rcv4-xf7x published
May 29, 2026 by nicolas-grekasModerate -
Information exposure via unescaped LIKE wildcards in EntitySearchUtilGHSA-946h-jp5c-8fvh published
May 29, 2026 by nicolas-grekasLow -
LiveComponentHydrator HMAC checksum lacks component and slot bindingGHSA-34w5-c283-j9fg published
May 29, 2026 by nicolas-grekasLow -
XSS in symfony/ux-autocomplete via unescaped AJAX response dataGHSA-mwqm-4fw3-cjvr published
May 29, 2026 by nicolas-grekasModerate -
CSRF Protection Bypass in symfony/ux-live-component — Accept Header is CORS-SafelistedGHSA-4m4j-hmqq-3gxm published
May 29, 2026 by nicolas-grekasLow -
Unsanitized HTML attribute injection via ComponentAttributesGHSA-5j3w-5pcr-f8hg published
May 19, 2025 by fabpotModerate