CVE-2023-46734

Name of the Vulnerable Software and Affected Versions Symfony versions 2.0.0 through 4.4.50 Symfony versions 5.0.0 through 5.4.30 Symfony versions 6.0.0 through 6.3.7

Description The issue exists due to some Twig filters in CodeExtension using is safe=html but not ensuring their input is safe. This could allow a remote attacker to disclose protected information, perform phishing attacks, and conduct drive-by downloads. Symfony now escapes the output of the affected filters to resolve the issue.

Recommendations For Symfony versions 2.0.0 through 4.4.50, update to version 4.4.51 or later. For Symfony versions 5.0.0 through 5.4.30, update to version 5.4.31 or later. For Symfony versions 6.0.0 through 6.3.7, update to version 6.3.8 or later. As a temporary workaround, consider restricting the use of the affected Twig filters in CodeExtension until a patch is applied.