MediumGHSA-q847-2q57-wmr3BIT-symfony-2023-46734CVE-2023-46734
Symfony potential Cross-site Scripting vulnerabilities in CodeExtension filters
Published 12 Nov 2023 · Updated 10 Sept 2026
Affected packages
symfony/twig-bridgeComposer
- Affected
- >=2.0.0 <4.4.51
- Fixed in
- 4.4.51
Update to the fixed version for your release line, for example:
composer require symfony/twig-bridge:^4.4.51symfony/twig-bridgeComposer
- Affected
- >=5.0.0 <5.4.31
- Fixed in
- 5.4.31
Update to the fixed version for your release line, for example:
composer require symfony/twig-bridge:^5.4.31symfony/twig-bridgeComposer
- Affected
- >=6.0.0 <6.3.8
- Fixed in
- 6.3.8
Update to the fixed version for your release line, for example:
composer require symfony/twig-bridge:^6.3.8symfony/symfonyComposer
- Affected
- >=2.0.0 <4.4.51
- Fixed in
- 4.4.51
Update to the fixed version for your release line, for example:
composer require symfony/symfony:^4.4.51symfony/symfonyComposer
- Affected
- >=5.0.0 <5.4.31
- Fixed in
- 5.4.31
Update to the fixed version for your release line, for example:
composer require symfony/symfony:^5.4.31symfony/symfonyComposer
- Affected
- >=6.0.0 <6.3.8
- Fixed in
- 6.3.8
Update to the fixed version for your release line, for example:
composer require symfony/symfony:^6.3.8Details
Description
Some Twig filters in CodeExtension use "is_safe=html" but don't actually ensure their input is safe.
Resolution
Symfony now escapes the output of the affected filters.
The patch for this issue is available here for branch 4.4.
Credits
We would like to thank Pierre Rudloff for reporting the issue and to Nicolas Grekas for providing the fix.
Is GHSA-q847-2q57-wmr3 in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected symfony/twig-bridge, and gives you the command that fixes it.
References
- Linkgithub.com/symfony/symfony/security/advisories/GHSA-q847-2q57-wmr3
- Advisorynvd.nist.gov/vuln/detail/CVE-2023-46734
- Linkgithub.com/symfony/symfony/commit/5d095d5feb1322b16450284a04d6bb48d1198f54
- Linkgithub.com/symfony/symfony/commit/9da9a145ce57e4585031ad4bee37c497353eec7c
- Linkgithub.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2023-46734.yaml
- Packagegithub.com/symfony/symfony
- Linklists.debian.org/debian-lts-announce/2023/11/msg00019.html
- Linksymfony.com/cve-2023-46734
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.