GHSA-q847-2q57-wmr3 Symfony potential Cross-site Scripting vulnerabilities in CodeExtension filters

• Packagist symfony/twig-bridge: >= 2.0.0, < 4.4.51 → fixed in 4.4.51 • Packagist symfony/twig-bridge: >= 5.0.0, < 5.4.31 → fixed in 5.4.31 • Packagist symfony/twig-bridge: >= 6.0.0, < 6.3.8 → fixed in 6.3.8 • Packagist symfony/symfony: >= 2.0.0, < 4.4.51 → fixed in 4.4.51 • Packagist symfony/symfony: >= 5.0.0, < 5.4.31 → fixed in 5.4.31 • Packagist symfony/symfony: >= 6.0.0, < 6.3.8 → fixed in 6.3.8

Description Some Twig filters in CodeExtension use "is_safe=html" but don't actually ensure their input is safe. Resolution Symfony now escapes the output of the affected filters. The patch for this issue is available here for branch 4.4. Credits We would like to thank Pierre Rudloff for reporting the issue and to Nicolas Grekas for providing the fix.