CVE-2026-55877 symfony CVE debrief

Who should care

Developers and administrators using Symfony UX versions 2.17.0 before 2.36.1 and 3.0.0 before 3.2.0 should be aware of this vulnerability and take steps to mitigate it. This includes operators, platform administrators, vulnerability management teams, and security teams who need to review and address the vulnerability.

Technical summary

The ux_icon() Twig function in Symfony UX is marked as is_safe=['html'] and Icon::toHtml() inlines SVG source verbatim. This allows unsanitized local SVG files or Iconify on-demand JSON body responses containing nested script elements, on* event handlers, or dangerous URL schemes to execute cross-site scripting. The vulnerability has a CVSS score of 6.1 and a severity of MEDIUM. Affected product context includes Symfony UX versions 2.17.0 before 2.36.1 and 3.0.0 before 3.2.0.

Defensive priority

Medium priority

Recommended defensive actions

• Update Symfony UX to version 2.36.1 or 3.2.0
• Validate and sanitize user input
• Implement content security policy
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions and retest remediated assets
• Confirm whether affected product deployments exist in managed environments

Evidence notes

The vulnerability is fixed in versions 2.36.1 and 3.2.0. The NVD entry is currently Awaiting Analysis. Evidence is limited to CVE and NVD information. Defenders should verify affected deployments, review official advisories, and plan updates or mitigations. Additional source grounding and evidence limits are needed to fully understand the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.