Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Symfony UX is a JavaScript ecosystem for Symfony. From 2.17.0 before 2.36.1 and from 3.0.0 before 3.2.0, the ux_icon() Twig function is marked is_safe=['html'] and Icon::toHtml() inlines SVG source verbatim, allowing unsanitized local SVG files or Iconify on-demand JSON body responses containing nested script elements, on* event handlers, or dangerous URL schemes to execute cross-site scripting. This issue is fixed in versions 2.36.1 and 3.2.0.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-06-20 | 1 | General1 |
| 2026-06-24 | 1 | Patch1 |
Two Symfony UX CVEs, patch now. → CVE-2026-55877: ux_icon() renders unsanitized SVG → XSS → CVE-2026-55878: path traversal in Toolkit installer Upgrade to UX 3.2.0 or 2.36.1.
Post summary
The advisory highlights two new Symfony UX CVEs and recommends upgrading to the patched versions 3.2.0 or 2.36.1 to mitigate XSS and path traversal vulnerabilities.
🔴 Symfony UX Icons, Cross-Site Scripting (XSS), #CVE-2026-55877 (Critical) -DC-Jun2026-522 https://dailycve.com/symfony-ux-icons-cross-site-scripting-xss-cve-2026-55877-critical-dc-jun2026-522/
Post summary
The statement merely announces the existence of CVE‑2026‑55877 as a critical XSS flaw in Symfony UX Icons, without providing PoC, exploit, or patch details.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | symfony | ux | - | - | - |