CVE-2026-55877: Symfony UX XSS Vulnerability

CVE-2026-55877 Overview

CVE-2026-55877 is a cross-site scripting (XSS) vulnerability in Symfony UX, a JavaScript ecosystem for Symfony applications. The flaw exists in the ux_icon() Twig function, which is marked is_safe=['html'], and in Icon::toHtml(), which inlines Scalable Vector Graphics (SVG) source verbatim. Attackers can leverage unsanitized local SVG files or Iconify on-demand JSON body responses containing nested <script> elements, on* event handlers, or dangerous URL schemes to execute arbitrary JavaScript in the victim's browser. The vulnerability affects Symfony UX versions from 2.17.0 before 2.36.1 and from 3.0.0 before 3.2.0. The issue is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Successful exploitation allows attackers to execute arbitrary JavaScript in victim browsers, enabling session hijacking, credential theft, and unauthorized actions within the application context.

Affected Products

Symfony UX 2.17.0 through versions before 2.36.1
Symfony UX 3.0.0 through versions before 3.2.0
Applications using the Symfony UX Icons component with Iconify integration or local SVG files

Discovery Timeline

2026-07-08 - CVE-2026-55877 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-55877

Vulnerability Analysis

The vulnerability originates in the Symfony UX Icons component's rendering pipeline. The ux_icon() Twig function is registered with is_safe=['html'], instructing Twig to bypass its automatic HTML escaping for the function's return value. This trust assumption is safe only if the rendered output contains sanitized markup.

The Icon::toHtml() method inlines SVG source verbatim into the response body. When SVG content originates from untrusted or attacker-influenced sources, malicious markup passes through unmodified. This chain enables reflected or stored XSS depending on where the SVG data is sourced.

Root Cause

The root cause is the combination of two design assumptions. First, the Twig function marks its output as safe HTML without validating the underlying SVG content. Second, Icon::toHtml() performs no sanitization on inlined SVG payloads. SVG is an XML dialect that permits executable content including <script> elements, on* event handlers such as onload and onclick, and URL schemes like javascript: inside href attributes.

Attack Vector

Attackers exploit this flaw through two primary sources. The first is a locally stored SVG file placed within the icon directory, either through a separate file upload flaw or supply-chain compromise. The second is the Iconify on-demand JSON body response, which the component fetches remotely and inlines. An attacker positioned to influence Iconify responses or the resolved icon set can inject SVG containing embedded JavaScript that executes when a victim's browser renders the containing page.

php

// Security patch in src/Icons/src/DependencyInjection/UXIconsExtension.php
// The fix unifies icon creation through IconFactory and adds sanitization
// for Iconify SVG output before rendering.

$container->getDefinition('.ux_icons.local_svg_icon_registry')
    ->setArgument(1, $mergedConfig['icon_dir'])
    ->setArgument(2, $iconSetPaths)
;

$container->getDefinition('.ux_icons.icon_finder')
// Source: https://github.com/symfony/ux/commit/3a4964ec3700f0af4e13f7bfbf8bb3174c3e79d1

Detection Methods for CVE-2026-55877

Indicators of Compromise

SVG files in the configured icon_dir containing <script> tags, on* event handler attributes, or javascript: URL schemes
Outbound HTTP requests to Iconify endpoints returning JSON body fields with embedded scriptable SVG payloads
Unexpected JavaScript execution or DOM modifications originating from <svg> elements inlined via ux_icon()
Web server logs showing requests to pages rendering user-influenced icon identifiers

Detection Strategies

Inventory Composer manifests to identify applications running symfony/ux-icons in vulnerable ranges (2.17.0 through 2.36.0, 3.0.0 through 3.1.x)
Scan the configured icon directory for SVG content matching regex patterns for <script, on[a-z]+=, or javascript: schemes
Deploy Content Security Policy (CSP) reporting to capture inline script violations triggered by rendered SVGs
Review Twig templates for calls to ux_icon() where the icon name derives from user input or untrusted external data

Monitoring Recommendations

Monitor egress traffic to api.iconify.design and cache invalidation events for the local icon registry
Alert on modifications to the icon_dir filesystem path outside of scheduled deployments
Log and review CSP violation reports for script-src and script-src-elem directives on pages using UX Icons

How to Mitigate CVE-2026-55877

Immediate Actions Required

Upgrade Symfony UX to version 2.36.1 for the 2.x branch or version 3.2.0 for the 3.x branch
Audit the configured icon_dir and remove any SVG files not sourced from trusted, verified sets
Disable or restrict the Iconify on-demand fetch feature if the application does not require dynamic icon resolution
Deploy a strict Content Security Policy that blocks inline scripts and restricts script-src to trusted origins

Patch Information

The maintainers released fixes in Symfony UX 2.36.1 and 3.2.0. The patch introduces an IconFactory service that unifies icon creation and sanitizes Iconify SVG output before it reaches the renderer. Review the GitHub Security Advisory GHSA-6v8j-33hc-mv84, the v2.36.1 release notes, and the v3.2.0 release notes for full details. The remediation commit is available at the Symfony UX repository.

Workarounds

Restrict ux_icon() invocations so the icon identifier cannot be influenced by user input or query parameters
Pre-sanitize any SVG files placed in the icon directory using a library such as DOMPurify server-side or an equivalent XML sanitizer
Serve pages that render icons with a Content-Security-Policy header disallowing inline scripts and unsafe-inline for script-src

bash

# Update Symfony UX via Composer to a patched release
composer require symfony/ux-icons:^2.36.1
# or for the 3.x branch
composer require symfony/ux-icons:^3.2.0

# Verify installed version
composer show symfony/ux-icons | grep versions