GHSA-g996-q5r8-w7g2 Symfony Cross-site Scripting (XSS) vulnerability

• Packagist symfony/symfony: >= 2.7.0, < 2.7.51 → fixed in 2.7.51 • Packagist symfony/symfony: >= 2.8.0, < 2.8.50 → fixed in 2.8.50 • Packagist symfony/symfony: >= 3.0.0, < 3.4.26 → fixed in 3.4.26 • Packagist symfony/symfony: >= 4.0.0, < 4.1.12 → fixed in 4.1.12 • Packagist symfony/symfony: >= 4.2.0, < 4.2.7 → fixed in 4.2.7 • Packagist symfony/framework-bundle: >= 2.7.0, < 2.7.51 → fixed in 2.7.51 • Packagist symfony/framework-bundle: >= 2.8.0, < 2.8.50 → fixed in 2.8.50 • Packagist symfony/framework-bundle: >= 3.0.0, < 3.4.26 → fixed in 3.4.26 • Packagist symfony/framework-bundle: >= 4.0.0, < 4.1.12 → fixed in 4.1.12 • Packagist symfony/framework-bundle: >= 4.2.0, < 4.2.7 → fixed in 4.2.7 • Packagist drupal/core: >= 8.0.0, < 8.5.15 → fixed in 8.5.15 • Packagist drupal/core: >= 8.6.0, < 8.6.15 → fixed in 8.6.15 • Packagist drupal/drupal: >= 8.0.0, < 8.5.15 → fixed in 8.5.15 • Packagist drupal/drupal: >= 8.6.0, < 8.6.15 → fixed in 8.6.15

In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, validation messages are not escaped, which can lead to XSS when user input is included. This is related to symfony/framework-bundle.