symfony/ux-icons

Renders local and remote SVG icons in your Twig templates.

View on Packagist

View on Github

Activity

Latest release: 3w ago
Total releases: 30
Cadence: ~33 days
Last 12 months: 11

Reach

Stars: 56

Details

License: MIT
First release: Apr 19, 2024

Releases

Version	Released
`v3.6.0` minor	Oct 07, 2026
`v3.5.1` patch	Sep 18, 2026
`v3.5.0` minor	Sep 18, 2026
`v3.4.0` minor	Jul 29, 2026
`v3.3.0` minor	Jun 19, 2026
`v2.36.1` patch	Jun 16, 2026
`v3.1.0` minor 1 CVE	May 22, 2026
`v3.0.0` major 1 CVE	Apr 09, 2026
`v2.36.0` minor 1 CVE	Apr 03, 2026
`v2.34.0` minor 1 CVE	Feb 26, 2026
`v2.32.0` minor 1 CVE	Dec 02, 2025
`v2.31.0` minor 1 CVE	Sep 30, 2025
`v2.30.0` minor 1 CVE	Aug 27, 2025
`v2.29.2` patch 1 CVE	Aug 14, 2025
`v2.29.0` minor 1 CVE	Aug 05, 2025
`v2.28.2` patch 1 CVE	Jul 30, 2025
`v2.28.0` minor 1 CVE	Jul 25, 2025
`v2.27.0` minor 1 CVE	Jun 17, 2025
`v2.26.0` minor 1 CVE	May 30, 2025
`v2.25.0` minor 1 CVE	Apr 07, 2025
`v2.24.0` minor 1 CVE	Apr 04, 2025
`v2.23.0` minor 1 CVE	Dec 26, 2024
`v2.22.1` patch 1 CVE	Dec 04, 2024
`v2.22.0` minor 1 CVE	Nov 29, 2024
`v2.21.0` minor 1 CVE	Oct 21, 2024
`v2.20.0` minor 1 CVE	Sep 18, 2024
`v2.19.0` minor 1 CVE	Aug 07, 2024
`v2.18.1` patch 1 CVE	Jun 07, 2024
`v2.18.0` minor 1 CVE	Jun 04, 2024
`v2.17.0` initial 1 CVE	Apr 19, 2024

Repository

symfony/ux-icons

Forks: 1
Open issues: 0
Language: PHP

icons
javascript
svg
symfony
symfony-ux
twig

Dependencies (3)

Depends on

v3.6.0

Used by

Supply-chain exposure

71 tracked projects depend on this, <1% of every package we track.

A known CVE here directly exposes every one of them.

Known CVEs (1)

CVE-2026-55877 GHSA-6v8j-33hc-mv84 Jun 19, 2026

symfony/ux-icons: XSS via unsanitized SVG content in local files and Iconify on-demand responses

6.1 / 10
Medium
Network Low None Required Changed Low Low None

Description

The ux_icon() Twig function is marked is_safe=['html'], so Twig never escapes its output. Icon::toHtml() inlines the SVG source verbatim into the page. Browsers execute <script> elements and on* event-handler attributes found inside inline SVG, making any unsanitized icon a vector for cross-site scripting.

Two code paths were affected. In the local file path, Icon::fromFile() only stripped <script> elements that were direct children of <svg>, leaving nested scripts and all on* attributes untouched despite a code comment claiming broader protection. In the Iconify on-demand path (enabled by default), the remote JSON body field was wrapped into an Icon object with no sanitization at all. Concrete attack vectors include a malicious SVG icon pack from a third-party theme or downloaded icon set, or a controlled Iconify endpoint configured via iconify.endpoint (including a poisoned cache).

Resolution

Introducing an IconFactory that centralizes sanitization across every icon source before an Icon object is created. The sanitizer removes script-capable elements (script, foreignObject, iframe, object, embed), SMIL animations targeting on*, href, or xlink:href attributes, CDATA sections, processing instructions, all on* attributes, and javascript:, vbscript:, and data:text/html URL schemes. <style> elements are kept for theming but have any handlers stripped. Icons that contain none of these constructs are byte-for-byte identical after sanitization.

Credits

Symfony would like to thank Pascal Cescon for reporting the issue and Hugo Alliaume for providing the fix.

Affected versions

v2.17.0v2.18.0v2.18.1v2.19.0v2.20.0v2.21.0v2.22.0v2.22.1v2.23.0v2.24.0v2.25.0v2.26.0

+ 14 more Show less

v2.27.0v2.28.0v2.28.2v2.29.0v2.29.2v2.30.0v2.31.0v2.32.0v2.33.0v2.34.0v2.35.0v2.36.0v3.0.0v3.1.0

Fixed in

2.36.13.2.0

References

https://github.com/symfony/ux/security/advisories/GHSA-6v8j-33hc-mv84
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/ux-icons/CVE-2026-55877.yaml
https://github.com/symfony/ux

Updated Sep 10, 2026 · Source: OSV.dev

Insights

Releases per month

last 12 months

Release mix

major 1
minor 22
patch 6

30 releases

Dependencies over time

per release

Minimum runtime

over time

Release calendar

2026

Jan

Feb

Mar

Apr

May

Jun

Jul

Aug

Sep

Oct

Nov

Dec

Less More