CVE-2023-46734

    Dashboard / Vulnerabilities / CVE-2023-46734

    CVE-2023-46734

    Published: 10 Nov 2023Last Modified: 15 Aug 2026

    Summary: Symfony potential Cross-site Scripting vulnerabilities in CodeExtension filters

    Details: Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Starting in versions 2.0.0, 5.0.0, and 6.0.0 and prior to versions 4.4.51, 5.4.31, and 6.3.8, some Twig filters in CodeExtension use `is_safe=html` but don't actually ensure their input is safe. As of versions 4.4.51, 5.4.31, and 6.3.8, Symfony now escapes the output of the affected filters.

    References: https://lists.debian.org/debian-lts-announce/2023/11/msg00019.html, https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/46xxx/CVE-2023-46734.json, https://github.com/symfony/symfony/security/advisories/GHSA-q847-2q57-wmr3, https://nvd.nist.gov/vuln/detail/CVE-2023-46734, https://github.com/symfony/symfony/commit/5d095d5feb1322b16450284a04d6bb48d1198f54, https://github.com/symfony/symfony/commit/9da9a145ce57e4585031ad4bee37c497353eec7c

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 18f96c1f4aff294d6872908741731ff0993dbd6f
    Fixed -6d3cd5a4deee9697738db8d24258890ca4140ae9

    Affected versions

    v6.3.6
    v6.3.5
    v6.3.4
    v6.3.2
    v6.3.1
    v6.3.0
    v6.3.0-RC1
    v6.3.0-BETA1
    v6.3.7
    v6.3.3
    v6.3.0-RC2
    v6.3.0-BETA3
    v6.3.0-BETA2

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-46734 | CVE-DB