AIKIDO-2026-10865
symfony/twig-bridge is vulnerable to Cross-site Scripting (XSS)
39
Low Risk
This Affects:
symfony/twig-bridgeTL;DR
CodeExtension::fileExcerpt() escapes PHP files through syntax highlighting but renders non-PHP file lines without escaping. If attacker-controlled content is written to a file later viewed through a profiler excerpt, it can execute as HTML or JavaScript. Pre-fix development profiler views can expose stored XSS to developers. The fix escapes non-PHP file contents before rendering excerpts.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
symfony/twig-bridge is vulnerable to Cross-site Scripting (XSS) in versions 6.4.24 - 6.4.39.
How to fix this
Upgrade the symfony/twig-bridge and/or symfony/symfony library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant