GHSA-p9fg-j6ww-953m
FOSRestBundle issue with broken validation of JSONP callbacks
Starting with FOSRestBundle 1.2 we switched to using willdurand/jsonp-callback-validator for validation of JSONP callbacks. However the change was implemented incorrectly validating the callback query param name, rather than its value. Anyone using the JSONP handler (which is off by default) together with FOSRestBundle 1.2.0 or 1.2.1 should update to FOSRestBundle 1.2.2.
What each source reports
GitHub AdvisoriesNo score
FOSRestBundle issue with broken validation of JSONP callbacks
Starting with FOSRestBundle 1.2 we switched to using willdurand/jsonp-callback-validator for validation of JSONP callbacks. However the change was implemented incorrectly validating the callback query param name, rather than its value. Anyone using the JSONP handler (which is off by default) together with FOSRestBundle 1.2.0 or 1.2.1 should update to FOSRestBundle 1.2.2.
- Record
GHSA-p9fg-j6ww-953m- Updated
- 2026-11-02
OSVNo score
FOSRestBundle issue with broken validation of JSONP callbacks
Starting with FOSRestBundle 1.2 we switched to using willdurand/jsonp-callback-validator for validation of JSONP callbacks. However the change was implemented incorrectly validating the callback query param name, rather than its value. Anyone using the JSONP handler (which is off by default) together with FOSRestBundle 1.2.0 or 1.2.1 should update to FOSRestBundle 1.2.2.
- Record
GHSA-p9fg-j6ww-953m- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
friendsofsymfony/rest-bundlePackagist | 1.2.0 up to 1.2.2 | 1.2.2 |
friendsofsymfony/rest-bundlePackagist | 1.2.0 up to 1.2.2, plus listed versions 1.2.1 | 1.2.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-p9fg-j6ww-953m is a vulnerability with no CVSS score yet in friendsofsymfony/rest-bundle, published May 15, 2024. No source lists public exploit code. Fixed in friendsofsymfony/rest-bundle 1.2.2.
References
github.com/FriendsOfSymfony/FOSRestBundle/commit/3dd7d40068360c23366fb4884c5d194c769ec2c1
symfony.com/blog/fosrestbundle-security-issue-with-jsonp-handler