| Package | Affected versions | Patched versions |
|---|---|---|
| symfony/symfony | ≥ 2.0.0, < 4.4.51≥ 5.0.0, < 5.4.31≥ 6.0.0, < 6.3.8 | 4.4.515.4.316.3.8 |
| symfony/twig-bridge | ≥ 2.0.0, < 4.4.51≥ 5.0.0, < 5.4.31≥ 6.0.0, < 6.3.8 | 4.4.515.4.316.3.8 |
| symfony | ≥ 2.0.0, < 4.4.51≥ 5.0.0, < 5.4.31≥ 6.0.0, < 6.3.8 | 4.4.515.4.316.3.8 |
| twig-bridge | ≥ 2.0.0, < 4.4.51≥ 5.0.0, < 5.4.31≥ 6.0.0, < 6.3.8 | 4.4.515.4.316.3.8 |
Some Twig filters in CodeExtension use "is_safe=html" but don't actually ensure their input is safe.
Symfony now escapes the output of the affected filters.
The patch for this issue is available here for branch 4.4.
We would like to thank Pierre Rudloff for reporting the issue and to Nicolas Grekas for providing the fix.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free