Symfony UX vulnerabilities

A vulnerability in Symfony UX allows CSRF attacks on LiveComponent components. The protection mechanism relies on the Accept header, which can be set by an attacker in a cross-origin request without preflight, enabling unauthorized actions on a victim's session.

A vulnerability in Symfony UX allows an attacker to swap a signed data blob between components or slots, enabling the setting of read-only properties on a target component. Affected versions are from 2.8.0 to 2.36.0 and 3.1.0.

A vulnerability in Symfony UX allows unauthenticated users to turn the public autocomplete endpoint into a broad matcher or blind boolean oracle. The issue is due to missing escaping of SQL LIKE wildcards (% , _ , \) in the client-supplied query.

A vulnerability in Symfony UX allows arbitrary HTML injection, including <script> tags, during Live Component re-rendering. The client-controlled children[id].tag value is interpolated directly into HTML without escaping or validation.

A vulnerability in Symfony UX allows an authenticated client to send a single _batch request with thousands of actions, exhausting server resources (CPU, memory, database connections) due to unbounded iteration over the actions array.

A vulnerability in Symfony UX allows an attacker to manipulate dates by sending relative strings (e.g., now, tomorrow, +10 years) to a LiveProp of type DateTimeInterface without a configured format. This bypasses time-based business logic checks.

A vulnerability in Symfony UX allows writing files to arbitrary locations or reading local files outside the recipe directory via a crafted recipe kit. The issue affects the ux:install console command which uses Path::isRelative() accepting paths like ../../../etc.

A vulnerability in Symfony UX allows XSS via the ux_icon() Twig function, which marks output as safe (is_safe=['html']) and embeds SVG source verbatim. Unsanitized local SVG files or Iconify JSON responses can contain malicious scripts, event handlers, or dangerous URL schemes.