CVE-2025-47946: Symfony UX Twig Component XSS Vulnerability

CVE-2025-47946 Overview

CVE-2025-47946 is a Cross-Site Scripting (XSS) vulnerability in Symfony UX, an initiative and set of libraries that integrate JavaScript tools into Symfony applications. Versions prior to 2.25.1 of symfony/ux-twig-component render {{ attributes }} and methods returning a ComponentAttributes instance (such as only(), defaults(), and without()) without escaping attribute values. When these values contain user-controlled input, attackers can inject arbitrary HTML attributes and JavaScript payloads. The symfony/ux-live-component package reuses the same ComponentAttributes class internally, so it inherits the same weakness [CWE-79]. The issue is fixed in version 2.25.1.

Critical Impact
Attackers can inject malicious HTML attributes and execute arbitrary JavaScript in the context of a victim's browser by supplying crafted input that reaches unescaped {{ attributes }} renderings in Twig components.

Affected Products

symfony/ux-twig-component prior to version 2.25.1
symfony/ux-live-component prior to version 2.25.1
Symfony applications using Twig components with user-controlled attribute values

Discovery Timeline

2025-05-19 - CVE-2025-47946 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-47946

Vulnerability Analysis

The flaw resides in how symfony/ux-twig-component renders HTML attributes attached to a component. When a Twig template calls {{ attributes }} or any derivative method that returns a ComponentAttributes instance, the library concatenates attribute values directly into the output stream without applying HTML attribute escaping. Any string flowing into a component attribute is treated as trusted markup.

An attacker who controls a value passed into a component attribute can break out of the intended attribute context. Injected payloads such as event handlers (onmouseover, onclick) or attribute-terminating characters produce reflected or stored XSS depending on how the application persists the input. User interaction is required for exploitation, since the payload triggers when a victim renders or interacts with the affected component.

Root Cause

The root cause is missing output encoding in the ComponentAttributes rendering path. Twig's autoescape mechanism escapes variables in element content but does not automatically escape values interpolated as HTML attributes when the component library writes them directly. The fix introduces an HtmlAttributeEscaper that applies attribute-context escaping to values before they are emitted.

Attack Vector

Exploitation requires an attacker to influence a value that is later rendered through {{ attributes }}, attributes.only(), attributes.defaults(), or attributes.without() in a Twig component. A typical vector is a form field, query parameter, or database record that is passed as a component prop and reflected as an attribute. The attacker crafts input containing quote characters and injected attributes, then lures a victim to load the rendered page.

php

// Patch reference from src/LiveComponent/composer.json
// Bumps the minimum ux-twig-component version to the fixed release
"symfony/ux-twig-component": "^2.25",
"twig/twig": "^3.10.3"

Source: Symfony UX security commit b5d1c85

Detection Methods for CVE-2025-47946

Indicators of Compromise

Unexpected HTML attributes (for example onerror, onmouseover, onclick) appearing in rendered component output.
Web server or application logs showing request parameters containing quote characters, angle brackets, or javascript: schemes that map to Twig component props.
Content Security Policy (CSP) violation reports referencing inline event handlers on component-rendered elements.

Detection Strategies

Inventory Composer dependencies with composer show symfony/ux-twig-component symfony/ux-live-component to identify versions below 2.25.1.
Perform static analysis of Twig templates for direct use of {{ attributes }}, attributes.only(), attributes.defaults(), and attributes.without() where inputs may be untrusted.
Add automated XSS payload tests to CI that submit attribute-breaking strings through forms and inspect rendered HTML for injected tokens.

Monitoring Recommendations

Forward web application firewall (WAF) and application logs to a centralized analytics platform to correlate attribute-injection payloads with affected component endpoints.
Enable and monitor CSP report-uri or report-to endpoints to surface inline handler violations that indicate successful or attempted injection.
Track anomalous authenticated sessions and outbound requests from user browsers following interaction with Twig-rendered pages.

How to Mitigate CVE-2025-47946

Immediate Actions Required

Upgrade symfony/ux-twig-component to version 2.25.1 or later using composer update symfony/ux-twig-component.
Upgrade symfony/ux-live-component to version 2.25.1 or later, since it reuses the vulnerable ComponentAttributes class internally.
Audit Twig templates for direct rendering of {{ attributes }} and replace with per-attribute safe rendering where input trust is unclear.

Patch Information

The fix is delivered in symfony/ux-twig-component version 2.25.1, which introduces an HtmlAttributeEscaper that applies attribute-context escaping before values are emitted. The Live Component package bumps its constraint to symfony/ux-twig-component: ^2.25 to pull in the corrected escaper. Details are available in the GitHub Security Advisory GHSA-5j3w-5pcr-f8hg and the patch commit b5d1c85.

Workarounds

Avoid rendering {{ attributes }} or objects derived from it directly when values may contain untrusted input.
Render individual attributes with {{ attributes.render('name') }}, which applies safe output for a specific attribute.
Validate and sanitize any user-controlled data before passing it into component props that back HTML attributes.

bash

# Upgrade the vulnerable packages to the fixed release
composer require symfony/ux-twig-component:^2.25.1 \
                 symfony/ux-live-component:^2.25.1

# Verify installed versions
composer show symfony/ux-twig-component symfony/ux-live-component