packagist package report

Is symfony/var-exporter safe?

1 known vulnerability, worst severity CRITICAL.

cvss

9.0

how bad it is if exploited, out of 10

epss

3.4%

chance of exploitation in the next 30 days

xyz score

4.0

CyberXYZ composite, out of 10

fig. 01 — GHSA-w4rc-rx25-8m86, the advisory selected below

// advisories

GHSA-w4rc-rx25-8m86

CRITICALCVE-2019-11325

An issue was discovered in Symfony before 4.2.12 and 4.3.x before 4.3.8. The VarExport component incorrectly escapes strings, allowing some specially crafted ones to escalate to execution of arbitrary PHP code. This is related to symfony/var-exporter.

Affected: >= 4.3.0, < 4.3.8, >= 4.2.0, < 4.2.12
Fixed in: 4.3.8
Weakness: CWE-116
Published: 2020-02-12
Source: github

GHSA NVD MITRE reference reference reference reference reference reference reference

// dependencies

0 direct

// ai model usage

Tracked for PyPI packages. HuggingFace models declare Python dependencies, so packagist packages are not covered.

Checked 2026-09-22 at 00:50 UTC. The most recent advisory here was published 2020-02-12. Updated continuously from NVD, GHSA, OSV and CNA feeds.

Is symfony/var-exporter safe? packagist package security report | CyberXYZ