AIKIDO-2026-10961

TL;DR

Symfony UnicodeString restores internal string state through __unserialize when a serialized UnicodeString object is decoded. Before the fix, assigning attacker-controlled values from the serialized array into the typed string property let PHP coerce Stringable objects via __toString before the post-assignment type check ran. A crafted serialized UnicodeString payload could therefore invoke attacker-chosen __toString logic during unserialize and contribute to a broader object-injection chain when applications pass untrusted serialized data to PHP unserialize. The fix rejects Stringable objects in the raw serialized data before any assignment to the string property.