{"action":"Upgrade symfony/symfony to 2.7.51 or later.","affected":[{"fixed":"2.7.51","introduced":"2.7.0"},{"fixed":"2.8.50","introduced":"2.8.0"},{"fixed":"3.4.26","introduced":"3.0.0"},{"fixed":"4.1.12","introduced":"4.0.0"},{"fixed":"4.2.7","introduced":"4.2.0"}],"component":"symfony/symfony","cve_ids":["CVE-2019-10909"],"ecosystem":"Packagist","epss":0.01029,"exploited":false,"fixed_versions":["2.7.51","2.8.50","3.4.26","4.1.12","4.2.7"],"ghsa_id":"GHSA-g996-q5r8-w7g2","id":"tcs_01M5KF2J5X9BH1NF67XBSHT2SY","modified_at":"2024-02-16T08:21:49.261419Z","published_at":"2019-11-12T23:00:53Z","references":["https://osv.dev/vulnerability/GHSA-g996-q5r8-w7g2","https://nvd.nist.gov/vuln/detail/CVE-2019-10909","https://github.com/symfony/symfony/commit/ab4d05358c3d0dd1a36fc8c306829f68e3dd84e2","https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2019-10909.yaml","https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2019-10909.yaml","https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/framework-bundle/CVE-2019-10909.yaml","https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2019-10909.yaml","https://symfony.com/blog/cve-2019-10909-escape-validation-messages-in-the-php-templating-engine","https://symfony.com/cve-2019-10909","https://www.drupal.org/sa-core-2019-005","https://www.synology.com/security/advisory/Synology_SA_19_19"],"severity":{"label":"medium","score":5.4},"sources":[{"source":"osv","source_id":"GHSA-g996-q5r8-w7g2","url":"https://osv.dev/vulnerability/GHSA-g996-q5r8-w7g2"}],"summary":"Symfony Cross-site Scripting (XSS) vulnerability"}