Listen to this Post
The vulnerability resides in the `symfony/ux-icons` package, a component of the Symfony UX JavaScript ecosystem that provides Twig helpers for rendering icons. At its core, the flaw stems from the `ux_icon()` Twig function being marked with is_safe=['html']. This directive explicitly tells Twig to bypass its automatic output escaping, meaning any HTML or SVG content returned by this function is rendered directly into the page without sanitization.
The `Icon::toHtml()` method then inlines the SVG source code verbatim. Modern browsers parse and execute `
To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behavior or unique IDs on this site. Not consenting or withdrawing consent may adversely affect certain features and functions.
We do not sell your personal data. If you wish to exercise your rights under applicable privacy laws, please visit our Do Not Sell My Personal Information page.