Symfony UX is a JavaScript ecosystem for Symfony. From 2.17.0 before 2.36.1 and from 3.0.0 before 3.2.0, the ux_icon() Twig function is marked is_safe=['html'] and Icon::toHtml() inlines SVG source verbatim, allowing unsanitized local SVG files or Iconify on‑demand JSON body responses containing nested script elements, on* event handlers, or dangerous URL schemes to execute cross‑site scripting. This issue is fixed in versions 2.36.1 and 3.2.0.

Symfony UX bundles shipped with the are affected. The risk applies to applications using the ux_icon() function from versions 2.17.0 through 2.36.0 and from 3.0.0 through 3.1.9. Software developers deploying those bundle versions must upgrade to mitigate the vulnerability.

The CVSS score of 6.1 indicates a moderate severity. An EPSS score of < 1% suggests that while exploitation is unlikely, it is not absent. The vulnerability is not listed in the CISA KEV catalog, implying no confirmed public exploits. The attack vector is inferred: any web page rendering ux_icon() with an untrusted SVG source or a remote Iconify call could be leveraged to deliver the malicious payload, as the content is directly inserted into the DOM.