{"id":"CVE-2026-55877","aliases":["GHSA-6v8j-33hc-mv84"],"url":"https://o3.security/vulnerability/CVE-2026-55877","summary":"Symfony UX: XSS in symfony/ux-icons via unsanitized SVG content in local files and Iconify on-demand responses","details":"### Description\n\nThe `ux_icon()` Twig function is marked `is_safe=['html']`, so Twig never escapes its output. `Icon::toHtml()` inlines the SVG source verbatim into the page. Browsers execute `<script>` elements and `on*` event-handler attributes found inside inline SVG, making any unsanitized icon a vector for cross-site scripting.\n\nTwo code paths were affected. In the local file path, `Icon::fromFile()` only stripped `<script>` elements that were direct children of `<svg>`, leaving nested scripts and all `on*` attributes untouched despite a code comment claiming broader protection. In the Iconify on-demand path (enabled by default), the remote JSON `body` field was wrapped into an `Icon` object with no sanitization at all. Concrete attack vectors include a malicious SVG icon pack from a third-party theme or downloaded icon set, or a controlled Iconify endpoint configured via `iconify.endpoint` (including a poisoned cache).\n\n### Resolution\n\nIntroducing an `IconFactory` that centralizes sanitization across every icon source before an `Icon` object is created. The sanitizer removes script-capable elements (`script`, `foreignObject`, `iframe`, `object`, `embed`), SMIL animations targeting `on*`, `href`, or `xlink:href` attributes, CDATA sections, processing instructions, all `on*` attributes, and `javascript:`, `vbscript:`, and `data:text/html` URL schemes. \n`<style>` elements are kept for theming but have any handlers stripped. Icons that contain none of these constructs are byte-for-byte identical after sanitization. \n\n### Credits\n\nSymfony would like to thank Pascal Cescon for reporting the issue and Hugo Alliaume for providing the fix.","published":"2026-07-08T21:32:37.407Z","modified":"2026-10-28T02:31:06.075325561Z","cvss":{"score":6.1,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},"epss":{"score":0.00338,"percentile":0.27086,"asOf":"2026-09-16"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"symfony/ux-icons","fixedVersion":"2.36.1"},{"ecosystem":"Packagist","name":"symfony/ux-icons","fixedVersion":"3.2.0"}],"fix":{"url":"https://github.com/symfony/ux/commit/3a4964ec3700f0af4e13f7bfbf8bb3174c3e79d1","label":"symfony/ux@3a4964e"},"references":[{"type":"WEB","url":"https://github.com/symfony/ux/releases/tag/v2.36.1"},{"type":"WEB","url":"https://github.com/symfony/ux/releases/tag/v3.2.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55877.json"},{"type":"ADVISORY","url":"https://github.com/symfony/ux/security/advisories/GHSA-6v8j-33hc-mv84"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55877"},{"type":"FIX","url":"https://github.com/symfony/ux/commit/3a4964ec3700f0af4e13f7bfbf8bb3174c3e79d1"},{"type":"WEB","url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/ux-icons/CVE-2026-55877.yaml"},{"type":"PACKAGE","url":"https://github.com/symfony/ux"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:31:06.075325561Z"}}