{"action":"Upgrade symfony/ux-twig-component to 2.25.1 or later.","affected":[{"fixed":"2.25.1","introduced":"0"}],"component":"symfony/ux-twig-component","cve_ids":["CVE-2025-47946"],"ecosystem":"Packagist","epss":0.00252,"exploited":false,"fixed_versions":["2.25.1"],"ghsa_id":"GHSA-5j3w-5pcr-f8hg","id":"tcs_01M5KEW513P3974XB561XCKBF8","modified_at":"2025-08-29T21:46:48.281175Z","published_at":"2025-05-19T22:24:45Z","references":["https://osv.dev/vulnerability/GHSA-5j3w-5pcr-f8hg","https://github.com/symfony/ux/security/advisories/GHSA-5j3w-5pcr-f8hg","https://nvd.nist.gov/vuln/detail/CVE-2025-47946","https://github.com/symfony/ux-live-component/commit/7ad44cf56d750b9f56658ed986286a10da132ee7","https://github.com/symfony/ux-twig-component/commit/b5d4e77db69315aeb18d2238e0e7c943d340ce76","https://github.com/symfony/ux/commit/b5d1c85995c128cb926d47a96cfbfbd500b643a8","https://github.com/symfony/ux/commit/c2f7738ee0969c31df7514025a7f5fc6e153932d","https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/ux-live-component/CVE-2025-47946.yaml","https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/ux-twig-component/CVE-2025-47946.yaml","https://github.com/symfony/ux","https://symfony.com/blog/symfony-ux-cve-2025-47946-unsanitized-html-attribute-injection-via-componentattributes"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-5j3w-5pcr-f8hg","url":"https://osv.dev/vulnerability/GHSA-5j3w-5pcr-f8hg"}],"summary":"Symfony UX allows unsanitized HTML attribute injection via ComponentAttributes"}