[MEDIUM] symfony/ux-icons XSS via unsanitized SVG content in local files and Iconify on-demand responses

PKSA-2rqz-j593-s85p CVE-2026-55877 GHSA-6v8j-33hc-mv84

Affected package: symfony/ux-icons

Affected version: >=2.17.0,<2.36.1|>=3.0.0,<3.2.0

Reported by:
GitHub, FriendsOfPHP/security-advisories