ugh, composer.
There are 34 composer security advisories affecting our repositories.
Deserialization Gadget chain in Swift Mailer
Unguarded calls to __toString() when nesting an object into an array
Unguarded calls to __isset() and to array-accesses when the sandbox is enabled
Sandbox does not protect against resource exhaustion
The `spaceless` filter implicitly marks its output as safe
PHP code injection via `{% use %}` template name
Sandbox property allowlist bypass via the `column` filter (array_column on objects)
Sandbox filter, tag and function allow-list bypass when sandbox state changes between renders
`{% sandbox %}{% include %}` skips checkSecurity() on cached templates (incomplete fix for CVE-2024-45411)
Sandbox: multiple `__toString()` policy bypasses via unguarded string coercion points
Sandbox state regression in deprecated internal wrappers in `src/Resources/core.php`
Sandbox `__toString()` policy bypass via dynamic mapping keys
Sandbox `__toString()` policy bypass via `Traversable` in `join`/`replace` and `in`/`not in` operators
Sandbox property allowlist bypass via the `column` filter under `SourcePolicyInterface`
CVE-2026-45073: SQL Injection in PdoAdapter::doClear() via Unsanitized $prefix
CVE-2026-45071: XXE (Local File Disclosure) in DomCrawler::addXmlContent() via validateOnParse = true
CVE-2026-48736: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient
CVE-2026-45068: Argument Injection in SendmailTransport via Dash-Prefixed Recipient Address
CVE-2026-45067: Email Header / SMTP Command Injection via CRLF in Symfony\Component\Mime\Address
CVE-2026-45070: Email Header Injection via Non-Token Characters in Mime Parameter Names
CVE-2026-45077: Unauthenticated PHP Object Deserialization in MonologBridge server:log Listener
CVE-2026-46644: symfony/polyfill-intl-idn accepts xn-- labels whose Punycode payload decodes to ASCII-only: insecure equivalence
CVE-2026-45065: UrlGenerator Route-Requirement Bypass via Unanchored Regex Alternation → Off-Site //host URL Injection
CVE-2026-48784: UrlGenerator Dot-Segment Encoding Skips Every Other Chained `../` or `./` → Generated URL Collapses Off-Route Under RFC 3986 Normalization
CVE-2026-46626: SymfonyRuntime CVE-2024-50340 Patch Bypass: Web Requests Can Still Set APP_ENV/APP_DEBUG via parse_str/SAPI Argv Mismatch
CVE-2026-45072: Stored XSS in WebProfiler CodeExtension::fileExcerpt(): Unescaped Non-PHP File Rendering
CVE-2026-45133: YAML Parser Stack Exhaustion via Unbounded Recursion in Nested Blocks, Sequences, and Mappings
CVE-2026-45304: YAML Parser Exponential Memory Allocation via Recursive Collection-Alias Expansion ("Billion Laughs")
CVE-2026-45305: YAML Parser ReDoS via Catastrophic Backtracking in Parser::cleanup() Regex
Possible sandbox bypass when using a source policy
`template_from_string()` escapes a SourcePolicy-driven sandbox via synthesized template name
Sandbox property and method bypass via object-destructuring assignment
Arbitrary PHP code execution via `_self.(<string>)` macro-reference compilation
XSS in profiler HtmlDumper via unescaped template and profile names