{"id":"CVE-2019-10909","aliases":["GHSA-g996-q5r8-w7g2"],"url":"https://o3.security/vulnerability/CVE-2019-10909","summary":"Symfony Cross-site Scripting (XSS) vulnerability","details":"In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, validation messages are not escaped, which can lead to XSS when user input is included. This is related to symfony/framework-bundle.","published":"2019-05-16T22:29:00.283Z","modified":"2026-08-07T14:48:27.932455Z","cvss":{"score":5.4,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},"epss":{"score":0.01048,"percentile":0.6114,"asOf":"2026-08-23"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"symfony/symfony","fixedVersion":"2.7.51"},{"ecosystem":"Packagist","name":"symfony/symfony","fixedVersion":"2.8.50"},{"ecosystem":"Packagist","name":"symfony/symfony","fixedVersion":"3.4.26"},{"ecosystem":"Packagist","name":"symfony/symfony","fixedVersion":"4.1.12"},{"ecosystem":"Packagist","name":"symfony/symfony","fixedVersion":"4.2.7"},{"ecosystem":"Packagist","name":"symfony/framework-bundle","fixedVersion":"2.7.51"},{"ecosystem":"Packagist","name":"symfony/framework-bundle","fixedVersion":"2.8.50"},{"ecosystem":"Packagist","name":"symfony/framework-bundle","fixedVersion":"3.4.26"},{"ecosystem":"Packagist","name":"symfony/framework-bundle","fixedVersion":"4.1.12"},{"ecosystem":"Packagist","name":"symfony/framework-bundle","fixedVersion":"4.2.7"},{"ecosystem":"Packagist","name":"drupal/core","fixedVersion":"8.5.15"},{"ecosystem":"Packagist","name":"drupal/core","fixedVersion":"8.6.15"},{"ecosystem":"Packagist","name":"drupal/drupal","fixedVersion":"8.5.15"},{"ecosystem":"Packagist","name":"drupal/drupal","fixedVersion":"8.6.15"}],"fix":{"url":"https://github.com/symfony/symfony/commit/ab4d05358c3d0dd1a36fc8c306829f68e3dd84e2","label":"symfony/symfony@ab4d053"},"references":[{"type":"ADVISORY","url":"https://symfony.com/blog/cve-2019-10909-escape-validation-messages-in-the-php-templating-engine"},{"type":"ADVISORY","url":"https://www.drupal.org/sa-core-2019-005"},{"type":"ADVISORY","url":"https://www.synology.com/security/advisory/Synology_SA_19_19"},{"type":"FIX","url":"https://github.com/symfony/symfony/commit/ab4d05358c3d0dd1a36fc8c306829f68e3dd84e2"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-07T14:48:27.932455Z"}}