https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 19 Oct 2026 12:35:53 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-335364 EUVD-2026-335364 https://cve.radiocsirt.org/vuln/euvd-2026-335364 https://cve.radiocsirt.org/vuln/fkie_cve-2026-55877 <p>Symfony UX is a JavaScript ecosystem for Symfony. From 2.17.0 before 2.36.1 and from 3.0.0 before 3.2.0, the ux_icon() Twig function is marked is_safe=[&#39;html&#39;] and Icon::toHtml() inlines SVG source verbatim, allowing unsanitized local SVG files or Iconify on-demand JSON body responses containing nested script elements, on* event handlers, or dangerous URL schemes to execute cross-site scripting. This issue is fixed in versions 2.36.1 and 3.2.0.</p> <p>Symfony UX is a JavaScript ecosystem for Symfony. From 2.17.0 before 2.36.1 and from 3.0.0 before 3.2.0, the ux_icon() Twig function is marked is_safe=[&#39;html&#39;] and Icon::toHtml() inlines SVG source verbatim, allowing unsanitized local SVG files or Iconify on-demand JSON body responses containing nested script elements, on* event handlers, or dangerous URL schemes to execute cross-site scripting. This issue is fixed in versions 2.36.1 and 3.2.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-55877 https://cve.radiocsirt.org/vuln/ghsa-6v8j-33hc-mv84 <p><strong>Affected:</strong> Packagist: symfony/ux-icons</p> <p>### Description</p> <p>The `ux_icon()` Twig function is marked `is_safe=[&#39;html&#39;]`, so Twig never escapes its output. `Icon::toHtml()` inlines the SVG source verbatim into the page. Browsers execute `&lt;script&gt;` elements and `on*` event-handler attributes found inside inline SVG, making any unsanitized icon a vector for cross-site scripting.</p> <p>Two code paths were affected. In the local file path, `Icon::fromFile()` only stripped `&lt;script&gt;` elements that were direct children of `&lt;svg&gt;`, leaving nested scripts and all `on*` attributes untouched despite a code comment claiming broader protection. In the Iconify on-demand path (enabled by default), the remote JSON `body` field was wrapped into an `Icon` object with no sanitization at all. Concrete attack vectors include a malicious SVG icon pack from a third-party theme or downloaded icon set, or a controlled Iconify endpoint configured via `iconify.endpoint` (including a poisoned cache).</p> <p>### Resolution</p> <p>Introducing an `IconFactory` that centralizes sanitization across every icon source before an `Icon` object is created. The sanitizer removes script-capable elements (`script`, `foreignObject`, `iframe`, `object`, `embed`), SMIL animations targeting `on*`, `href`, or `xlink:href` attributes, CDATA sections, processing instructions, all `on*` attributes, and `javascript:`, `vbscript:`, and `data:text/html` URL schemes. `&lt;style&gt;` elements are kept for theming but have any handlers stripped. Icons that contain none of these constructs are…</p> <p><strong>Affected:</strong> Packagist: symfony/ux-icons</p> <p>### Description</p> <p>The `ux_icon()` Twig function is marked `is_safe=[&#39;html&#39;]`, so Twig never escapes its output. `Icon::toHtml()` inlines the SVG source verbatim into the page. Browsers execute `&lt;script&gt;` elements and `on*` event-handler attributes found inside inline SVG, making any unsanitized icon a vector for cross-site scripting.</p> <p>Two code paths were affected. In the local file path, `Icon::fromFile()` only stripped `&lt;script&gt;` elements that were direct children of `&lt;svg&gt;`, leaving nested scripts and all `on*` attributes untouched despite a code comment claiming broader protection. In the Iconify on-demand path (enabled by default), the remote JSON `body` field was wrapped into an `Icon` object with no sanitization at all. Concrete attack vectors include a malicious SVG icon pack from a third-party theme or downloaded icon set, or a controlled Iconify endpoint configured via `iconify.endpoint` (including a poisoned cache).</p> <p>### Resolution</p> <p>Introducing an `IconFactory` that centralizes sanitization across every icon source before an `Icon` object is created. The sanitizer removes script-capable elements (`script`, `foreignObject`, `iframe`, `object`, `embed`), SMIL animations targeting `on*`, `href`, or `xlink:href` attributes, CDATA sections, processing instructions, all `on*` attributes, and `javascript:`, `vbscript:`, and `data:text/html` URL schemes. `&lt;style&gt;` elements are kept for theming but have any handlers stripped. Icons that contain none of these constructs are…</p> https://cve.radiocsirt.org/vuln/ghsa-6v8j-33hc-mv84