Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-49216 (GCVE-0-2026-49216)

Vulnerability from nvd – Published: 2026-07-17 16:15 – Updated: 2026-07-21 01:44

Title

Symfony UX: XSS in symfony/ux-autocomplete via unescaped AJAX response data

Summary

Symfony UX is a JavaScript ecosystem for Symfony. From 2.2.0 until 2.36.0 and 3.1.0, the Stimulus controller in symfony/ux-autocomplete renders AJAX response items in _createAutocompleteWithRemoteData() by interpolating the text field into HTML template literals (<div>${item[labelField]}</div>) rather than text, allowing attacker-controlled markup from user-supplied dropdown values to execute in the browser of any user who opens an autocomplete widget backed by the same data. This issue is fixed in versions 2.36.0 and 3.1.0.

Severity

5.1 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-21 01:43 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M

References

4 references

URL	Tags
https://github.com/symfony/ux/security/advisories…	x_refsource_CONFIRM
https://github.com/symfony/ux/commit/842ae54bc74d…	x_refsource_MISC
https://github.com/symfony/ux/releases/tag/v2.36.0	x_refsource_MISC
https://github.com/symfony/ux/releases/tag/v3.1.0	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
symfony	ux	Affected: >= 3.0.0, < 3.1.0 Affected: < 2.36.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-49216",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-21T01:43:58.784121Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-21T01:44:13.539Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "ux",
          "vendor": "symfony",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.0.0, \u003c 3.1.0"
            },
            {
              "status": "affected",
              "version": "\u003c 2.36.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Symfony UX is a JavaScript ecosystem for Symfony. From 2.2.0 until 2.36.0 and 3.1.0, the Stimulus controller in symfony/ux-autocomplete renders AJAX response items in _createAutocompleteWithRemoteData() by interpolating the text field into HTML template literals (\u003cdiv\u003e${item[labelField]}\u003c/div\u003e) rather than text, allowing attacker-controlled markup from user-supplied dropdown values to execute in the browser of any user who opens an autocomplete widget backed by the same data. This issue is fixed in versions 2.36.0 and 3.1.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "ACTIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-17T16:15:34.990Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/symfony/ux/security/advisories/GHSA-mwqm-4fw3-cjvr",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/symfony/ux/security/advisories/GHSA-mwqm-4fw3-cjvr"
        },
        {
          "name": "https://github.com/symfony/ux/commit/842ae54bc74de389299f975f01aafae272cb0019",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/symfony/ux/commit/842ae54bc74de389299f975f01aafae272cb0019"
        },
        {
          "name": "https://github.com/symfony/ux/releases/tag/v2.36.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/symfony/ux/releases/tag/v2.36.0"
        },
        {
          "name": "https://github.com/symfony/ux/releases/tag/v3.1.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/symfony/ux/releases/tag/v3.1.0"
        }
      ],
      "source": {
        "advisory": "GHSA-mwqm-4fw3-cjvr",
        "discovery": "UNKNOWN"
      },
      "title": "Symfony UX: XSS in symfony/ux-autocomplete via unescaped AJAX response data"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-49216",
    "datePublished": "2026-07-17T16:15:34.990Z",
    "dateReserved": "2026-05-28T03:42:34.341Z",
    "dateUpdated": "2026-07-21T01:44:13.539Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-49215 (GCVE-0-2026-49215)

Vulnerability from nvd – Published: 2026-07-17 16:16 – Updated: 2026-07-17 18:05

Title

Symfony UX: CSRF Protection Bypass in symfony/ux-live-component — Accept Header is CORS-Safelisted

Summary

Symfony UX is a JavaScript ecosystem for Symfony. From 2.22.0 until 2.36.0 and 3.1.0, Symfony\UX\LiveComponent\EventListener\LiveComponentSubscriber::isLiveComponentRequest() gates #[LiveAction] invocations on Accept: application/vnd.live-component+html, but the Accept header is CORS-safelisted and cross-origin fetch() can set it without preflight, allowing forged cross-origin #[LiveAction] requests against a victim session when applications use SameSite=None, credentials: 'include', a permissive cookie policy, or a same-origin pivot. This issue is fixed in versions 2.36.0 and 3.1.0.

Severity

2.1 (Low)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-17 17:24 UTC

CWE

CWE-352 - Cross-Site Request Forgery (CSRF)

Assigner

GitHub_M

References

4 references

URL	Tags
https://github.com/symfony/ux/security/advisories…	x_refsource_CONFIRM
https://github.com/symfony/ux/commit/aed7493db2b4…	x_refsource_MISC
https://github.com/symfony/ux/releases/tag/v2.36.0	x_refsource_MISC
https://github.com/symfony/ux/releases/tag/v3.1.0	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
symfony	ux	Affected: >= 3.0.0, < 3.1.0 Affected: >= 2.22.0, < 2.36.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-49215",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-17T17:24:08.463081Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-17T18:05:15.930Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "ux",
          "vendor": "symfony",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.0.0, \u003c 3.1.0"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.22.0, \u003c 2.36.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Symfony UX is a JavaScript ecosystem for Symfony. From 2.22.0 until 2.36.0 and 3.1.0, Symfony\\UX\\LiveComponent\\EventListener\\LiveComponentSubscriber::isLiveComponentRequest() gates #[LiveAction] invocations on Accept: application/vnd.live-component+html, but the Accept header is CORS-safelisted and cross-origin fetch() can set it without preflight, allowing forged cross-origin #[LiveAction] requests against a victim session when applications use SameSite=None, credentials: \u0027include\u0027, a permissive cookie policy, or a same-origin pivot. This issue is fixed in versions 2.36.0 and 3.1.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.1,
            "baseSeverity": "LOW",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352: Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-17T16:16:42.126Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/symfony/ux/security/advisories/GHSA-4m4j-hmqq-3gxm",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/symfony/ux/security/advisories/GHSA-4m4j-hmqq-3gxm"
        },
        {
          "name": "https://github.com/symfony/ux/commit/aed7493db2b4b7bf1f9c79b33cda544f06904b27",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/symfony/ux/commit/aed7493db2b4b7bf1f9c79b33cda544f06904b27"
        },
        {
          "name": "https://github.com/symfony/ux/releases/tag/v2.36.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/symfony/ux/releases/tag/v2.36.0"
        },
        {
          "name": "https://github.com/symfony/ux/releases/tag/v3.1.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/symfony/ux/releases/tag/v3.1.0"
        }
      ],
      "source": {
        "advisory": "GHSA-4m4j-hmqq-3gxm",
        "discovery": "UNKNOWN"
      },
      "title": "Symfony UX: CSRF Protection Bypass in symfony/ux-live-component \u2014 Accept Header is CORS-Safelisted"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-49215",
    "datePublished": "2026-07-17T16:16:42.126Z",
    "dateReserved": "2026-05-28T03:42:34.341Z",
    "dateUpdated": "2026-07-17T18:05:15.930Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-49212 (GCVE-0-2026-49212)

Vulnerability from nvd – Published: 2026-07-17 16:03 – Updated: 2026-07-17 17:48

Title

Symfony UX: LiveComponentHydrator HMAC checksum lacks component and slot binding

Summary

Symfony UX is a JavaScript ecosystem for Symfony. From 2.8.0 until 2.36.0 and 3.1.0, the HMAC computed by Symfony\UX\LiveComponent\LiveComponentHydrator covered only sorted prop key/value pairs and did not include the component name, the slot identifier (props vs propsFromParent), or request context, allowing a signed blob minted for one component or slot to be replayed in another and set a read-only prop on a target component. This issue is fixed in versions 2.36.0 and 3.1.0.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-17 17:48 UTC

CWE

CWE-345 - Insufficient Verification of Data Authenticity

Assigner

GitHub_M

References

4 references

URL	Tags
https://github.com/symfony/ux/security/advisories…	x_refsource_CONFIRM
https://github.com/symfony/ux/commit/a224b5af3e2e…	x_refsource_MISC
https://github.com/symfony/ux/releases/tag/v2.36.0	x_refsource_MISC
https://github.com/symfony/ux/releases/tag/v3.1.0	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
symfony	ux	Affected: >= 3.0.0, < 3.1.0 Affected: < 2.36.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-49212",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-17T17:48:30.843991Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-17T17:48:49.503Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "ux",
          "vendor": "symfony",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.0.0, \u003c 3.1.0"
            },
            {
              "status": "affected",
              "version": "\u003c 2.36.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Symfony UX is a JavaScript ecosystem for Symfony. From 2.8.0 until 2.36.0 and 3.1.0, the HMAC computed by Symfony\\UX\\LiveComponent\\LiveComponentHydrator covered only sorted prop key/value pairs and did not include the component name, the slot identifier (props vs propsFromParent), or request context, allowing a signed blob minted for one component or slot to be replayed in another and set a read-only prop on a target component. This issue is fixed in versions 2.36.0 and 3.1.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-345",
              "description": "CWE-345: Insufficient Verification of Data Authenticity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-17T16:03:27.784Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/symfony/ux/security/advisories/GHSA-34w5-c283-j9fg",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/symfony/ux/security/advisories/GHSA-34w5-c283-j9fg"
        },
        {
          "name": "https://github.com/symfony/ux/commit/a224b5af3e2e33ee14ac71356ae0e0877900a81c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/symfony/ux/commit/a224b5af3e2e33ee14ac71356ae0e0877900a81c"
        },
        {
          "name": "https://github.com/symfony/ux/releases/tag/v2.36.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/symfony/ux/releases/tag/v2.36.0"
        },
        {
          "name": "https://github.com/symfony/ux/releases/tag/v3.1.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/symfony/ux/releases/tag/v3.1.0"
        }
      ],
      "source": {
        "advisory": "GHSA-34w5-c283-j9fg",
        "discovery": "UNKNOWN"
      },
      "title": "Symfony UX: LiveComponentHydrator HMAC checksum lacks component and slot binding"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-49212",
    "datePublished": "2026-07-17T16:03:27.784Z",
    "dateReserved": "2026-05-28T03:42:34.340Z",
    "dateUpdated": "2026-07-17T17:48:49.503Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-49211 (GCVE-0-2026-49211)

Vulnerability from nvd – Published: 2026-07-17 16:14 – Updated: 2026-07-17 16:41

Title

Symfony UX: Information exposure via unescaped LIKE wildcards in EntitySearchUtil

Summary

Symfony UX is a JavaScript ecosystem for Symfony. From 2.2.0 until 2.36.0 and 3.1.0, Symfony\UX\Autocomplete\Doctrine\EntitySearchUtil::addSearchClause() builds the LIKE expression used by the autocomplete endpoint by wrapping the client-supplied query in %...% without escaping SQL LIKE wildcards (%, _, \), allowing unauthenticated users to turn the public BaseEntityAutocompleteType endpoint into a broad matcher or blind boolean oracle against every column in default searchable_fields. This issue is fixed in versions 2.36.0 and 3.1.0.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-17 16:41 UTC

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Assigner

GitHub_M

References

4 references

URL	Tags
https://github.com/symfony/ux/security/advisories…	x_refsource_CONFIRM
https://github.com/symfony/ux/commit/725ab3d40689…	x_refsource_MISC
https://github.com/symfony/ux/releases/tag/v2.36.0	x_refsource_MISC
https://github.com/symfony/ux/releases/tag/v3.1.0	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
symfony	ux	Affected: >= 3.0.0, < 3.1.0 Affected: >= 2.2.0, < 2.36.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-49211",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-17T16:41:23.015801Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-17T16:41:33.402Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "ux",
          "vendor": "symfony",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.0.0, \u003c 3.1.0"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.2.0, \u003c 2.36.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Symfony UX is a JavaScript ecosystem for Symfony. From 2.2.0 until 2.36.0 and 3.1.0, Symfony\\UX\\Autocomplete\\Doctrine\\EntitySearchUtil::addSearchClause() builds the LIKE expression used by the autocomplete endpoint by wrapping the client-supplied query in %...% without escaping SQL LIKE wildcards (%, _, \\), allowing unauthenticated users to turn the public BaseEntityAutocompleteType endpoint into a broad matcher or blind boolean oracle against every column in default searchable_fields. This issue is fixed in versions 2.36.0 and 3.1.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-17T16:14:29.271Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/symfony/ux/security/advisories/GHSA-946h-jp5c-8fvh",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/symfony/ux/security/advisories/GHSA-946h-jp5c-8fvh"
        },
        {
          "name": "https://github.com/symfony/ux/commit/725ab3d40689c91ff19ad2d01940a30007769214",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/symfony/ux/commit/725ab3d40689c91ff19ad2d01940a30007769214"
        },
        {
          "name": "https://github.com/symfony/ux/releases/tag/v2.36.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/symfony/ux/releases/tag/v2.36.0"
        },
        {
          "name": "https://github.com/symfony/ux/releases/tag/v3.1.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/symfony/ux/releases/tag/v3.1.0"
        }
      ],
      "source": {
        "advisory": "GHSA-946h-jp5c-8fvh",
        "discovery": "UNKNOWN"
      },
      "title": "Symfony UX: Information exposure via unescaped LIKE wildcards in EntitySearchUtil"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-49211",
    "datePublished": "2026-07-17T16:14:29.271Z",
    "dateReserved": "2026-05-28T03:42:34.340Z",
    "dateUpdated": "2026-07-17T16:41:33.402Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-49210 (GCVE-0-2026-49210)

Vulnerability from nvd – Published: 2026-07-17 16:09 – Updated: 2026-07-17 16:52

Title

Symfony UX: XSS in symfony/ux-live-component via attacker-controlled child component tag

Summary

Symfony UX is a JavaScript ecosystem for Symfony. From 2.8.0 until 2.36.0 and 3.1.0, Symfony\UX\LiveComponent\Util\ChildComponentPartialRenderer::createHtml() interpolates the client-controlled children[id].tag value from LiveComponentSubscriber and InterceptChildComponentRenderSubscriber directly into HTML as a tag name without escaping or validation, allowing arbitrary HTML, including <script> tags, on any Live Component re-render that contains at least one child component. This issue is fixed in versions 2.36.0 and 3.1.0.

Severity

2.3 (Low)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-17 16:52 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M

References

4 references

URL	Tags
https://github.com/symfony/ux/security/advisories…	x_refsource_CONFIRM
https://github.com/symfony/ux/commit/fbc5e9a1bda7…	x_refsource_MISC
https://github.com/symfony/ux/releases/tag/v2.36.0	x_refsource_MISC
https://github.com/symfony/ux/releases/tag/v3.1.0	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
symfony	ux	Affected: >= 3.0.0, < 3.1.0 Affected: >= 2.8.0, < 2.36.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-49210",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-17T16:52:49.114369Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-17T16:52:59.836Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "ux",
          "vendor": "symfony",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.0.0, \u003c 3.1.0"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.8.0, \u003c 2.36.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Symfony UX is a JavaScript ecosystem for Symfony. From 2.8.0 until 2.36.0 and 3.1.0, Symfony\\UX\\LiveComponent\\Util\\ChildComponentPartialRenderer::createHtml() interpolates the client-controlled children[id].tag value from LiveComponentSubscriber and InterceptChildComponentRenderSubscriber directly into HTML as a tag name without escaping or validation, allowing arbitrary HTML, including \u003cscript\u003e tags, on any Live Component re-render that contains at least one child component. This issue is fixed in versions 2.36.0 and 3.1.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-17T16:09:59.645Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/symfony/ux/security/advisories/GHSA-38x5-rcv4-xf7x",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/symfony/ux/security/advisories/GHSA-38x5-rcv4-xf7x"
        },
        {
          "name": "https://github.com/symfony/ux/commit/fbc5e9a1bda7e4556be21bb1d970f382760ed9a9",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/symfony/ux/commit/fbc5e9a1bda7e4556be21bb1d970f382760ed9a9"
        },
        {
          "name": "https://github.com/symfony/ux/releases/tag/v2.36.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/symfony/ux/releases/tag/v2.36.0"
        },
        {
          "name": "https://github.com/symfony/ux/releases/tag/v3.1.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/symfony/ux/releases/tag/v3.1.0"
        }
      ],
      "source": {
        "advisory": "GHSA-38x5-rcv4-xf7x",
        "discovery": "UNKNOWN"
      },
      "title": "Symfony UX: XSS in symfony/ux-live-component via attacker-controlled child component tag"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-49210",
    "datePublished": "2026-07-17T16:09:17.850Z",
    "dateReserved": "2026-05-28T03:42:34.340Z",
    "dateUpdated": "2026-07-17T16:52:59.836Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-49209 (GCVE-0-2026-49209)

Vulnerability from nvd – Published: 2026-07-17 16:02 – Updated: 2026-07-17 17:26

Title

Symfony UX: Denial of service in symfony/ux-live-component via unbounded batch action requests

Summary

Symfony UX is a JavaScript ecosystem for Symfony. From 2.5.0 until 2.36.0 and 3.1.0, Symfony\UX\LiveComponent\Controller\BatchActionController::__invoke() iterates over the client-supplied actions array and issues a full HttpKernel sub-request for each entry; because the array size is never bounded, an authenticated client can submit a single _batch request containing thousands of actions and exhaust CPU, memory, and database connections on the application server. This issue is fixed in versions 2.36.0 and 3.1.0.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-17 17:26 UTC

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

GitHub_M

References

4 references

URL	Tags
https://github.com/symfony/ux/security/advisories…	x_refsource_CONFIRM
https://github.com/symfony/ux/commit/95e878d5257f…	x_refsource_MISC
https://github.com/symfony/ux/releases/tag/v2.36.0	x_refsource_MISC
https://github.com/symfony/ux/releases/tag/v3.1.0	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
symfony	ux	Affected: >= 3.0.0, < 3.1.0 Affected: >= 2.5.0, < 2.36.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-49209",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-17T17:26:12.348589Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-17T17:26:18.929Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "ux",
          "vendor": "symfony",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.0.0, \u003c 3.1.0"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.5.0, \u003c 2.36.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Symfony UX is a JavaScript ecosystem for Symfony. From 2.5.0 until 2.36.0 and 3.1.0, Symfony\\UX\\LiveComponent\\Controller\\BatchActionController::__invoke() iterates over the client-supplied actions array and issues a full HttpKernel sub-request for each entry; because the array size is never bounded, an authenticated client can submit a single _batch request containing thousands of actions and exhaust CPU, memory, and database connections on the application server. This issue is fixed in versions 2.36.0 and 3.1.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-17T16:02:06.498Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/symfony/ux/security/advisories/GHSA-mm82-c99c-h2cf",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/symfony/ux/security/advisories/GHSA-mm82-c99c-h2cf"
        },
        {
          "name": "https://github.com/symfony/ux/commit/95e878d5257f13d6d652ca95e3ef6bb0934d674f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/symfony/ux/commit/95e878d5257f13d6d652ca95e3ef6bb0934d674f"
        },
        {
          "name": "https://github.com/symfony/ux/releases/tag/v2.36.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/symfony/ux/releases/tag/v2.36.0"
        },
        {
          "name": "https://github.com/symfony/ux/releases/tag/v3.1.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/symfony/ux/releases/tag/v3.1.0"
        }
      ],
      "source": {
        "advisory": "GHSA-mm82-c99c-h2cf",
        "discovery": "UNKNOWN"
      },
      "title": "Symfony UX: Denial of service in symfony/ux-live-component via unbounded batch action requests"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-49209",
    "datePublished": "2026-07-17T16:02:06.498Z",
    "dateReserved": "2026-05-28T03:42:34.340Z",
    "dateUpdated": "2026-07-17T17:26:18.929Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-49208 (GCVE-0-2026-49208)

Vulnerability from nvd – Published: 2026-07-17 16:10 – Updated: 2026-07-21 01:41

Title

Symfony UX: Format-less date LiveProps parsed with the permissive DateTime constructor

Summary

Symfony UX is a JavaScript ecosystem for Symfony. From 2.8.0 until 2.36.0 and 3.1.0, when a #[LiveProp] is typed as DateTimeInterface and no explicit format is configured, Symfony\UX\LiveComponent\LiveComponentHydrator::hydrateObjectValue() falls back to new $className($value), allowing client-supplied relative strings such as now, tomorrow, or +10 years to move a writable, format-less date prop past time-based business logic checks. This issue is fixed in versions 2.36.0 and 3.1.0.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-21 01:41 UTC

CWE

CWE-20 - Improper Input Validation

Assigner

GitHub_M

References

4 references

URL	Tags
https://github.com/symfony/ux/security/advisories…	x_refsource_CONFIRM
https://github.com/symfony/ux/commit/d24d78fda6df…	x_refsource_MISC
https://github.com/symfony/ux/releases/tag/v2.36.0	x_refsource_MISC
https://github.com/symfony/ux/releases/tag/v3.1.0	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
symfony	ux	Affected: >= 3.0.0, < 3.1.0 Affected: >= 2.8.0, < 2.36.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-49208",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-21T01:41:38.338710Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-21T01:41:46.730Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "ux",
          "vendor": "symfony",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.0.0, \u003c 3.1.0"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.8.0, \u003c 2.36.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Symfony UX is a JavaScript ecosystem for Symfony. From 2.8.0 until 2.36.0 and 3.1.0, when a #[LiveProp] is typed as DateTimeInterface and no explicit format is configured, Symfony\\UX\\LiveComponent\\LiveComponentHydrator::hydrateObjectValue() falls back to new $className($value), allowing client-supplied relative strings such as now, tomorrow, or +10 years to move a writable, format-less date prop past time-based business logic checks. This issue is fixed in versions 2.36.0 and 3.1.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20: Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-17T16:10:49.101Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/symfony/ux/security/advisories/GHSA-89g7-22c8-3j23",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/symfony/ux/security/advisories/GHSA-89g7-22c8-3j23"
        },
        {
          "name": "https://github.com/symfony/ux/commit/d24d78fda6df2d5964312255943ebf3a217b79a2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/symfony/ux/commit/d24d78fda6df2d5964312255943ebf3a217b79a2"
        },
        {
          "name": "https://github.com/symfony/ux/releases/tag/v2.36.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/symfony/ux/releases/tag/v2.36.0"
        },
        {
          "name": "https://github.com/symfony/ux/releases/tag/v3.1.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/symfony/ux/releases/tag/v3.1.0"
        }
      ],
      "source": {
        "advisory": "GHSA-89g7-22c8-3j23",
        "discovery": "UNKNOWN"
      },
      "title": "Symfony UX: Format-less date LiveProps parsed with the permissive DateTime constructor"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-49208",
    "datePublished": "2026-07-17T16:10:49.101Z",
    "dateReserved": "2026-05-28T03:42:34.340Z",
    "dateUpdated": "2026-07-21T01:41:46.730Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-55878 (GCVE-0-2026-55878)

Vulnerability from nvd – Published: 2026-07-08 21:30 – Updated: 2026-07-09 14:19

Title

Symfony: Path Traversal in symfony/ux-toolkit Allows Arbitrary File Write and Read via Crafted Recipe Manifest

Summary

Symfony UX is a JavaScript ecosystem for Symfony. From 2.32.0 before 2.36.1 and from 3.0.0 before 3.2.0, the ux:install console command installs files from a recipe kit by copying paths listed in a copy-files map, and because Path::isRelative() accepts paths like ../../../etc, a crafted or compromised kit can write attacker-controlled content to arbitrary locations or read local files outside the recipe directory. This issue is fixed in versions 2.36.1 and 3.2.0.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-09 14:18 UTC

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

GitHub_M

References

4 references

URL	Tags
https://github.com/symfony/ux/security/advisories…	x_refsource_CONFIRM
https://github.com/symfony/ux/commit/7b4ddf3764bf…	x_refsource_MISC
https://github.com/symfony/ux/releases/tag/v2.36.1	x_refsource_MISC
https://github.com/symfony/ux/releases/tag/v3.2.0	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
symfony	ux	Affected: >= 2.32.0, < 2.36.1 Affected: >= 3.0.0, < 3.2.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-55878",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-09T14:18:56.012444Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-09T14:19:07.068Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "ux",
          "vendor": "symfony",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.32.0, \u003c 2.36.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.0.0, \u003c 3.2.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Symfony UX is a JavaScript ecosystem for Symfony. From 2.32.0 before 2.36.1 and from 3.0.0 before 3.2.0, the ux:install console command installs files from a recipe kit by copying paths listed in a copy-files map, and because Path::isRelative() accepts paths like ../../../etc, a crafted or compromised kit can write attacker-controlled content to arbitrary locations or read local files outside the recipe directory. This issue is fixed in versions 2.36.1 and 3.2.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-08T21:30:33.816Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/symfony/ux/security/advisories/GHSA-p9xj-fpr2-jf2q",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/symfony/ux/security/advisories/GHSA-p9xj-fpr2-jf2q"
        },
        {
          "name": "https://github.com/symfony/ux/commit/7b4ddf3764bf269a1b5fde5bf03c4bce568694e4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/symfony/ux/commit/7b4ddf3764bf269a1b5fde5bf03c4bce568694e4"
        },
        {
          "name": "https://github.com/symfony/ux/releases/tag/v2.36.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/symfony/ux/releases/tag/v2.36.1"
        },
        {
          "name": "https://github.com/symfony/ux/releases/tag/v3.2.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/symfony/ux/releases/tag/v3.2.0"
        }
      ],
      "source": {
        "advisory": "GHSA-p9xj-fpr2-jf2q",
        "discovery": "UNKNOWN"
      },
      "title": "Symfony: Path Traversal in symfony/ux-toolkit Allows Arbitrary File Write and Read via Crafted Recipe Manifest"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-55878",
    "datePublished": "2026-07-08T21:30:33.816Z",
    "dateReserved": "2026-06-17T16:59:42.759Z",
    "dateUpdated": "2026-07-09T14:19:07.068Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-55877 (GCVE-0-2026-55877)

Vulnerability from nvd – Published: 2026-07-08 21:32 – Updated: 2026-07-09 14:40

Title

Symfony UX: XSS in symfony/ux-icons via unsanitized SVG content in local files and Iconify on-demand responses

Summary

Symfony UX is a JavaScript ecosystem for Symfony. From 2.17.0 before 2.36.1 and from 3.0.0 before 3.2.0, the ux_icon() Twig function is marked is_safe=['html'] and Icon::toHtml() inlines SVG source verbatim, allowing unsanitized local SVG files or Iconify on-demand JSON body responses containing nested script elements, on* event handlers, or dangerous URL schemes to execute cross-site scripting. This issue is fixed in versions 2.36.1 and 3.2.0.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-09 14:21 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M

References

4 references

URL	Tags
https://github.com/symfony/ux/security/advisories…	x_refsource_CONFIRM
https://github.com/symfony/ux/commit/3a4964ec3700…	x_refsource_MISC
https://github.com/symfony/ux/releases/tag/v2.36.1	x_refsource_MISC
https://github.com/symfony/ux/releases/tag/v3.2.0	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
symfony	ux	Affected: >= 2.17.0, < 2.36.1 Affected: >= 3.0.0, < 3.2.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-55877",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-09T14:21:00.657899Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-09T14:40:25.026Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "ux",
          "vendor": "symfony",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.17.0, \u003c 2.36.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.0.0, \u003c 3.2.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Symfony UX is a JavaScript ecosystem for Symfony. From 2.17.0 before 2.36.1 and from 3.0.0 before 3.2.0, the ux_icon() Twig function is marked is_safe=[\u0027html\u0027] and Icon::toHtml() inlines SVG source verbatim, allowing unsanitized local SVG files or Iconify on-demand JSON body responses containing nested script elements, on* event handlers, or dangerous URL schemes to execute cross-site scripting. This issue is fixed in versions 2.36.1 and 3.2.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-08T21:32:37.407Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/symfony/ux/security/advisories/GHSA-6v8j-33hc-mv84",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/symfony/ux/security/advisories/GHSA-6v8j-33hc-mv84"
        },
        {
          "name": "https://github.com/symfony/ux/commit/3a4964ec3700f0af4e13f7bfbf8bb3174c3e79d1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/symfony/ux/commit/3a4964ec3700f0af4e13f7bfbf8bb3174c3e79d1"
        },
        {
          "name": "https://github.com/symfony/ux/releases/tag/v2.36.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/symfony/ux/releases/tag/v2.36.1"
        },
        {
          "name": "https://github.com/symfony/ux/releases/tag/v3.2.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/symfony/ux/releases/tag/v3.2.0"
        }
      ],
      "source": {
        "advisory": "GHSA-6v8j-33hc-mv84",
        "discovery": "UNKNOWN"
      },
      "title": "Symfony UX: XSS in symfony/ux-icons via unsanitized SVG content in local files and Iconify on-demand responses"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-55877",
    "datePublished": "2026-07-08T21:32:37.407Z",
    "dateReserved": "2026-06-17T16:59:42.759Z",
    "dateUpdated": "2026-07-09T14:40:25.026Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-47946 (GCVE-0-2025-47946)

Vulnerability from nvd – Published: 2025-05-19 19:25 – Updated: 2025-05-20 13:01

Title

symfony/ux-live-component and symfony/ux-twig-component vulnerable to unsanitized HTML attribute injection via ComponentAttributes

Summary

Symfony UX is an initiative and set of libraries to integrate JavaScript tools into applications. Prior to version 2.25.1, rendering `{{ attributes }}` or using any method that returns a `ComponentAttributes` instance (e.g. `only()`, `defaults()`, `without()`) ouputs attribute values directly without escaping. If these values are unsafe (e.g. contain user input), this can lead to HTML attribute injection and XSS vulnerabilities. The issue is fixed in version `2.25.1` of `symfony/ux-twig-component` Those who use `symfony/ux-live-component` must also update it to `2.25.1` to benefit from the fix, as it reuses the `ComponentAttributes` class internally. As a workaround, avoid rendering `{{ attributes }}` or derived objects directly if it may contain untrusted values. Instead, use `{{ attributes.render('name') }}` for safe output of individual attributes.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-05-20 13:01 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M

References

2 references

URL	Tags
https://github.com/symfony/ux/security/advisories…	x_refsource_CONFIRM
https://github.com/symfony/ux/commit/b5d1c85995c1…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
symfony	ux	Affected: < 2.25.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-47946",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-20T13:01:03.682812Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-20T13:01:10.237Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "ux",
          "vendor": "symfony",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.25.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Symfony UX is an initiative and set of libraries to integrate JavaScript tools into applications. Prior to version 2.25.1, rendering `{{ attributes }}` or using any method that returns a `ComponentAttributes` instance (e.g. `only()`, `defaults()`, `without()`) ouputs attribute values directly without escaping. If these values are unsafe (e.g. contain user input), this can lead to HTML attribute injection and XSS vulnerabilities. The issue is fixed in version `2.25.1` of `symfony/ux-twig-component` Those who use `symfony/ux-live-component` must also update it to `2.25.1` to benefit from the fix, as it reuses the `ComponentAttributes` class internally. As a workaround, avoid rendering `{{ attributes }}` or derived objects directly if it may contain untrusted values.\nInstead, use `{{ attributes.render(\u0027name\u0027) }}` for safe output of individual attributes."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-19T19:25:19.350Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/symfony/ux/security/advisories/GHSA-5j3w-5pcr-f8hg",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/symfony/ux/security/advisories/GHSA-5j3w-5pcr-f8hg"
        },
        {
          "name": "https://github.com/symfony/ux/commit/b5d1c85995c128cb926d47a96cfbfbd500b643a8",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/symfony/ux/commit/b5d1c85995c128cb926d47a96cfbfbd500b643a8"
        }
      ],
      "source": {
        "advisory": "GHSA-5j3w-5pcr-f8hg",
        "discovery": "UNKNOWN"
      },
      "title": "symfony/ux-live-component and symfony/ux-twig-component vulnerable to unsanitized HTML attribute injection via ComponentAttributes"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-47946",
    "datePublished": "2025-05-19T19:25:19.350Z",
    "dateReserved": "2025-05-14T10:32:43.530Z",
    "dateUpdated": "2025-05-20T13:01:10.237Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2026-49215 (GCVE-0-2026-49215)

Vulnerability from cvelistv5 – Published: 2026-07-17 16:16 – Updated: 2026-07-17 18:05

Title

Symfony UX: CSRF Protection Bypass in symfony/ux-live-component — Accept Header is CORS-Safelisted

Summary

Symfony UX is a JavaScript ecosystem for Symfony. From 2.22.0 until 2.36.0 and 3.1.0, Symfony\UX\LiveComponent\EventListener\LiveComponentSubscriber::isLiveComponentRequest() gates #[LiveAction] invocations on Accept: application/vnd.live-component+html, but the Accept header is CORS-safelisted and cross-origin fetch() can set it without preflight, allowing forged cross-origin #[LiveAction] requests against a victim session when applications use SameSite=None, credentials: 'include', a permissive cookie policy, or a same-origin pivot. This issue is fixed in versions 2.36.0 and 3.1.0.

Severity

2.1 (Low)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-17 17:24 UTC

CWE

CWE-352 - Cross-Site Request Forgery (CSRF)

Assigner

GitHub_M

References

4 references

URL	Tags
https://github.com/symfony/ux/security/advisories…	x_refsource_CONFIRM
https://github.com/symfony/ux/commit/aed7493db2b4…	x_refsource_MISC
https://github.com/symfony/ux/releases/tag/v2.36.0	x_refsource_MISC
https://github.com/symfony/ux/releases/tag/v3.1.0	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
symfony	ux	Affected: >= 3.0.0, < 3.1.0 Affected: >= 2.22.0, < 2.36.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-49215",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-17T17:24:08.463081Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-17T18:05:15.930Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "ux",
          "vendor": "symfony",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.0.0, \u003c 3.1.0"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.22.0, \u003c 2.36.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Symfony UX is a JavaScript ecosystem for Symfony. From 2.22.0 until 2.36.0 and 3.1.0, Symfony\\UX\\LiveComponent\\EventListener\\LiveComponentSubscriber::isLiveComponentRequest() gates #[LiveAction] invocations on Accept: application/vnd.live-component+html, but the Accept header is CORS-safelisted and cross-origin fetch() can set it without preflight, allowing forged cross-origin #[LiveAction] requests against a victim session when applications use SameSite=None, credentials: \u0027include\u0027, a permissive cookie policy, or a same-origin pivot. This issue is fixed in versions 2.36.0 and 3.1.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.1,
            "baseSeverity": "LOW",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352: Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-17T16:16:42.126Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/symfony/ux/security/advisories/GHSA-4m4j-hmqq-3gxm",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/symfony/ux/security/advisories/GHSA-4m4j-hmqq-3gxm"
        },
        {
          "name": "https://github.com/symfony/ux/commit/aed7493db2b4b7bf1f9c79b33cda544f06904b27",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/symfony/ux/commit/aed7493db2b4b7bf1f9c79b33cda544f06904b27"
        },
        {
          "name": "https://github.com/symfony/ux/releases/tag/v2.36.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/symfony/ux/releases/tag/v2.36.0"
        },
        {
          "name": "https://github.com/symfony/ux/releases/tag/v3.1.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/symfony/ux/releases/tag/v3.1.0"
        }
      ],
      "source": {
        "advisory": "GHSA-4m4j-hmqq-3gxm",
        "discovery": "UNKNOWN"
      },
      "title": "Symfony UX: CSRF Protection Bypass in symfony/ux-live-component \u2014 Accept Header is CORS-Safelisted"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-49215",
    "datePublished": "2026-07-17T16:16:42.126Z",
    "dateReserved": "2026-05-28T03:42:34.341Z",
    "dateUpdated": "2026-07-17T18:05:15.930Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-49216 (GCVE-0-2026-49216)

Vulnerability from cvelistv5 – Published: 2026-07-17 16:15 – Updated: 2026-07-21 01:44

Title

Symfony UX: XSS in symfony/ux-autocomplete via unescaped AJAX response data

Summary

Symfony UX is a JavaScript ecosystem for Symfony. From 2.2.0 until 2.36.0 and 3.1.0, the Stimulus controller in symfony/ux-autocomplete renders AJAX response items in _createAutocompleteWithRemoteData() by interpolating the text field into HTML template literals (<div>${item[labelField]}</div>) rather than text, allowing attacker-controlled markup from user-supplied dropdown values to execute in the browser of any user who opens an autocomplete widget backed by the same data. This issue is fixed in versions 2.36.0 and 3.1.0.

Severity

5.1 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-21 01:43 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M

References

4 references

URL	Tags
https://github.com/symfony/ux/security/advisories…	x_refsource_CONFIRM
https://github.com/symfony/ux/commit/842ae54bc74d…	x_refsource_MISC
https://github.com/symfony/ux/releases/tag/v2.36.0	x_refsource_MISC
https://github.com/symfony/ux/releases/tag/v3.1.0	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
symfony	ux	Affected: >= 3.0.0, < 3.1.0 Affected: < 2.36.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-49216",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-21T01:43:58.784121Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-21T01:44:13.539Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "ux",
          "vendor": "symfony",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.0.0, \u003c 3.1.0"
            },
            {
              "status": "affected",
              "version": "\u003c 2.36.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Symfony UX is a JavaScript ecosystem for Symfony. From 2.2.0 until 2.36.0 and 3.1.0, the Stimulus controller in symfony/ux-autocomplete renders AJAX response items in _createAutocompleteWithRemoteData() by interpolating the text field into HTML template literals (\u003cdiv\u003e${item[labelField]}\u003c/div\u003e) rather than text, allowing attacker-controlled markup from user-supplied dropdown values to execute in the browser of any user who opens an autocomplete widget backed by the same data. This issue is fixed in versions 2.36.0 and 3.1.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "ACTIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-17T16:15:34.990Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/symfony/ux/security/advisories/GHSA-mwqm-4fw3-cjvr",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/symfony/ux/security/advisories/GHSA-mwqm-4fw3-cjvr"
        },
        {
          "name": "https://github.com/symfony/ux/commit/842ae54bc74de389299f975f01aafae272cb0019",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/symfony/ux/commit/842ae54bc74de389299f975f01aafae272cb0019"
        },
        {
          "name": "https://github.com/symfony/ux/releases/tag/v2.36.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/symfony/ux/releases/tag/v2.36.0"
        },
        {
          "name": "https://github.com/symfony/ux/releases/tag/v3.1.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/symfony/ux/releases/tag/v3.1.0"
        }
      ],
      "source": {
        "advisory": "GHSA-mwqm-4fw3-cjvr",
        "discovery": "UNKNOWN"
      },
      "title": "Symfony UX: XSS in symfony/ux-autocomplete via unescaped AJAX response data"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-49216",
    "datePublished": "2026-07-17T16:15:34.990Z",
    "dateReserved": "2026-05-28T03:42:34.341Z",
    "dateUpdated": "2026-07-21T01:44:13.539Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-49211 (GCVE-0-2026-49211)

Vulnerability from cvelistv5 – Published: 2026-07-17 16:14 – Updated: 2026-07-17 16:41

Title

Symfony UX: Information exposure via unescaped LIKE wildcards in EntitySearchUtil

Summary

Symfony UX is a JavaScript ecosystem for Symfony. From 2.2.0 until 2.36.0 and 3.1.0, Symfony\UX\Autocomplete\Doctrine\EntitySearchUtil::addSearchClause() builds the LIKE expression used by the autocomplete endpoint by wrapping the client-supplied query in %...% without escaping SQL LIKE wildcards (%, _, \), allowing unauthenticated users to turn the public BaseEntityAutocompleteType endpoint into a broad matcher or blind boolean oracle against every column in default searchable_fields. This issue is fixed in versions 2.36.0 and 3.1.0.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-17 16:41 UTC

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Assigner

GitHub_M

References

4 references

URL	Tags
https://github.com/symfony/ux/security/advisories…	x_refsource_CONFIRM
https://github.com/symfony/ux/commit/725ab3d40689…	x_refsource_MISC
https://github.com/symfony/ux/releases/tag/v2.36.0	x_refsource_MISC
https://github.com/symfony/ux/releases/tag/v3.1.0	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
symfony	ux	Affected: >= 3.0.0, < 3.1.0 Affected: >= 2.2.0, < 2.36.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-49211",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-17T16:41:23.015801Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-17T16:41:33.402Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "ux",
          "vendor": "symfony",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.0.0, \u003c 3.1.0"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.2.0, \u003c 2.36.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Symfony UX is a JavaScript ecosystem for Symfony. From 2.2.0 until 2.36.0 and 3.1.0, Symfony\\UX\\Autocomplete\\Doctrine\\EntitySearchUtil::addSearchClause() builds the LIKE expression used by the autocomplete endpoint by wrapping the client-supplied query in %...% without escaping SQL LIKE wildcards (%, _, \\), allowing unauthenticated users to turn the public BaseEntityAutocompleteType endpoint into a broad matcher or blind boolean oracle against every column in default searchable_fields. This issue is fixed in versions 2.36.0 and 3.1.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-17T16:14:29.271Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/symfony/ux/security/advisories/GHSA-946h-jp5c-8fvh",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/symfony/ux/security/advisories/GHSA-946h-jp5c-8fvh"
        },
        {
          "name": "https://github.com/symfony/ux/commit/725ab3d40689c91ff19ad2d01940a30007769214",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/symfony/ux/commit/725ab3d40689c91ff19ad2d01940a30007769214"
        },
        {
          "name": "https://github.com/symfony/ux/releases/tag/v2.36.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/symfony/ux/releases/tag/v2.36.0"
        },
        {
          "name": "https://github.com/symfony/ux/releases/tag/v3.1.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/symfony/ux/releases/tag/v3.1.0"
        }
      ],
      "source": {
        "advisory": "GHSA-946h-jp5c-8fvh",
        "discovery": "UNKNOWN"
      },
      "title": "Symfony UX: Information exposure via unescaped LIKE wildcards in EntitySearchUtil"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-49211",
    "datePublished": "2026-07-17T16:14:29.271Z",
    "dateReserved": "2026-05-28T03:42:34.340Z",
    "dateUpdated": "2026-07-17T16:41:33.402Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-49208 (GCVE-0-2026-49208)

Vulnerability from cvelistv5 – Published: 2026-07-17 16:10 – Updated: 2026-07-21 01:41

Title

Symfony UX: Format-less date LiveProps parsed with the permissive DateTime constructor

Summary

Symfony UX is a JavaScript ecosystem for Symfony. From 2.8.0 until 2.36.0 and 3.1.0, when a #[LiveProp] is typed as DateTimeInterface and no explicit format is configured, Symfony\UX\LiveComponent\LiveComponentHydrator::hydrateObjectValue() falls back to new $className($value), allowing client-supplied relative strings such as now, tomorrow, or +10 years to move a writable, format-less date prop past time-based business logic checks. This issue is fixed in versions 2.36.0 and 3.1.0.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-21 01:41 UTC

CWE

CWE-20 - Improper Input Validation

Assigner

GitHub_M

References

4 references

URL	Tags
https://github.com/symfony/ux/security/advisories…	x_refsource_CONFIRM
https://github.com/symfony/ux/commit/d24d78fda6df…	x_refsource_MISC
https://github.com/symfony/ux/releases/tag/v2.36.0	x_refsource_MISC
https://github.com/symfony/ux/releases/tag/v3.1.0	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
symfony	ux	Affected: >= 3.0.0, < 3.1.0 Affected: >= 2.8.0, < 2.36.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-49208",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-21T01:41:38.338710Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-21T01:41:46.730Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "ux",
          "vendor": "symfony",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.0.0, \u003c 3.1.0"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.8.0, \u003c 2.36.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Symfony UX is a JavaScript ecosystem for Symfony. From 2.8.0 until 2.36.0 and 3.1.0, when a #[LiveProp] is typed as DateTimeInterface and no explicit format is configured, Symfony\\UX\\LiveComponent\\LiveComponentHydrator::hydrateObjectValue() falls back to new $className($value), allowing client-supplied relative strings such as now, tomorrow, or +10 years to move a writable, format-less date prop past time-based business logic checks. This issue is fixed in versions 2.36.0 and 3.1.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20: Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-17T16:10:49.101Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/symfony/ux/security/advisories/GHSA-89g7-22c8-3j23",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/symfony/ux/security/advisories/GHSA-89g7-22c8-3j23"
        },
        {
          "name": "https://github.com/symfony/ux/commit/d24d78fda6df2d5964312255943ebf3a217b79a2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/symfony/ux/commit/d24d78fda6df2d5964312255943ebf3a217b79a2"
        },
        {
          "name": "https://github.com/symfony/ux/releases/tag/v2.36.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/symfony/ux/releases/tag/v2.36.0"
        },
        {
          "name": "https://github.com/symfony/ux/releases/tag/v3.1.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/symfony/ux/releases/tag/v3.1.0"
        }
      ],
      "source": {
        "advisory": "GHSA-89g7-22c8-3j23",
        "discovery": "UNKNOWN"
      },
      "title": "Symfony UX: Format-less date LiveProps parsed with the permissive DateTime constructor"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-49208",
    "datePublished": "2026-07-17T16:10:49.101Z",
    "dateReserved": "2026-05-28T03:42:34.340Z",
    "dateUpdated": "2026-07-21T01:41:46.730Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-49210 (GCVE-0-2026-49210)

Vulnerability from cvelistv5 – Published: 2026-07-17 16:09 – Updated: 2026-07-17 16:52

Title

Symfony UX: XSS in symfony/ux-live-component via attacker-controlled child component tag

Summary

Symfony UX is a JavaScript ecosystem for Symfony. From 2.8.0 until 2.36.0 and 3.1.0, Symfony\UX\LiveComponent\Util\ChildComponentPartialRenderer::createHtml() interpolates the client-controlled children[id].tag value from LiveComponentSubscriber and InterceptChildComponentRenderSubscriber directly into HTML as a tag name without escaping or validation, allowing arbitrary HTML, including <script> tags, on any Live Component re-render that contains at least one child component. This issue is fixed in versions 2.36.0 and 3.1.0.

Severity

2.3 (Low)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-17 16:52 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M

References

4 references

URL	Tags
https://github.com/symfony/ux/security/advisories…	x_refsource_CONFIRM
https://github.com/symfony/ux/commit/fbc5e9a1bda7…	x_refsource_MISC
https://github.com/symfony/ux/releases/tag/v2.36.0	x_refsource_MISC
https://github.com/symfony/ux/releases/tag/v3.1.0	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
symfony	ux	Affected: >= 3.0.0, < 3.1.0 Affected: >= 2.8.0, < 2.36.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-49210",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-17T16:52:49.114369Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-17T16:52:59.836Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "ux",
          "vendor": "symfony",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.0.0, \u003c 3.1.0"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.8.0, \u003c 2.36.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Symfony UX is a JavaScript ecosystem for Symfony. From 2.8.0 until 2.36.0 and 3.1.0, Symfony\\UX\\LiveComponent\\Util\\ChildComponentPartialRenderer::createHtml() interpolates the client-controlled children[id].tag value from LiveComponentSubscriber and InterceptChildComponentRenderSubscriber directly into HTML as a tag name without escaping or validation, allowing arbitrary HTML, including \u003cscript\u003e tags, on any Live Component re-render that contains at least one child component. This issue is fixed in versions 2.36.0 and 3.1.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-17T16:09:59.645Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/symfony/ux/security/advisories/GHSA-38x5-rcv4-xf7x",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/symfony/ux/security/advisories/GHSA-38x5-rcv4-xf7x"
        },
        {
          "name": "https://github.com/symfony/ux/commit/fbc5e9a1bda7e4556be21bb1d970f382760ed9a9",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/symfony/ux/commit/fbc5e9a1bda7e4556be21bb1d970f382760ed9a9"
        },
        {
          "name": "https://github.com/symfony/ux/releases/tag/v2.36.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/symfony/ux/releases/tag/v2.36.0"
        },
        {
          "name": "https://github.com/symfony/ux/releases/tag/v3.1.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/symfony/ux/releases/tag/v3.1.0"
        }
      ],
      "source": {
        "advisory": "GHSA-38x5-rcv4-xf7x",
        "discovery": "UNKNOWN"
      },
      "title": "Symfony UX: XSS in symfony/ux-live-component via attacker-controlled child component tag"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-49210",
    "datePublished": "2026-07-17T16:09:17.850Z",
    "dateReserved": "2026-05-28T03:42:34.340Z",
    "dateUpdated": "2026-07-17T16:52:59.836Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-49212 (GCVE-0-2026-49212)

Vulnerability from cvelistv5 – Published: 2026-07-17 16:03 – Updated: 2026-07-17 17:48

Title

Symfony UX: LiveComponentHydrator HMAC checksum lacks component and slot binding

Summary

Symfony UX is a JavaScript ecosystem for Symfony. From 2.8.0 until 2.36.0 and 3.1.0, the HMAC computed by Symfony\UX\LiveComponent\LiveComponentHydrator covered only sorted prop key/value pairs and did not include the component name, the slot identifier (props vs propsFromParent), or request context, allowing a signed blob minted for one component or slot to be replayed in another and set a read-only prop on a target component. This issue is fixed in versions 2.36.0 and 3.1.0.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-17 17:48 UTC

CWE

CWE-345 - Insufficient Verification of Data Authenticity

Assigner

GitHub_M

References

4 references

URL	Tags
https://github.com/symfony/ux/security/advisories…	x_refsource_CONFIRM
https://github.com/symfony/ux/commit/a224b5af3e2e…	x_refsource_MISC
https://github.com/symfony/ux/releases/tag/v2.36.0	x_refsource_MISC
https://github.com/symfony/ux/releases/tag/v3.1.0	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
symfony	ux	Affected: >= 3.0.0, < 3.1.0 Affected: < 2.36.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-49212",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-17T17:48:30.843991Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-17T17:48:49.503Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "ux",
          "vendor": "symfony",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.0.0, \u003c 3.1.0"
            },
            {
              "status": "affected",
              "version": "\u003c 2.36.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Symfony UX is a JavaScript ecosystem for Symfony. From 2.8.0 until 2.36.0 and 3.1.0, the HMAC computed by Symfony\\UX\\LiveComponent\\LiveComponentHydrator covered only sorted prop key/value pairs and did not include the component name, the slot identifier (props vs propsFromParent), or request context, allowing a signed blob minted for one component or slot to be replayed in another and set a read-only prop on a target component. This issue is fixed in versions 2.36.0 and 3.1.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-345",
              "description": "CWE-345: Insufficient Verification of Data Authenticity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-17T16:03:27.784Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/symfony/ux/security/advisories/GHSA-34w5-c283-j9fg",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/symfony/ux/security/advisories/GHSA-34w5-c283-j9fg"
        },
        {
          "name": "https://github.com/symfony/ux/commit/a224b5af3e2e33ee14ac71356ae0e0877900a81c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/symfony/ux/commit/a224b5af3e2e33ee14ac71356ae0e0877900a81c"
        },
        {
          "name": "https://github.com/symfony/ux/releases/tag/v2.36.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/symfony/ux/releases/tag/v2.36.0"
        },
        {
          "name": "https://github.com/symfony/ux/releases/tag/v3.1.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/symfony/ux/releases/tag/v3.1.0"
        }
      ],
      "source": {
        "advisory": "GHSA-34w5-c283-j9fg",
        "discovery": "UNKNOWN"
      },
      "title": "Symfony UX: LiveComponentHydrator HMAC checksum lacks component and slot binding"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-49212",
    "datePublished": "2026-07-17T16:03:27.784Z",
    "dateReserved": "2026-05-28T03:42:34.340Z",
    "dateUpdated": "2026-07-17T17:48:49.503Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-49209 (GCVE-0-2026-49209)

Vulnerability from cvelistv5 – Published: 2026-07-17 16:02 – Updated: 2026-07-17 17:26

Title

Symfony UX: Denial of service in symfony/ux-live-component via unbounded batch action requests

Summary

Symfony UX is a JavaScript ecosystem for Symfony. From 2.5.0 until 2.36.0 and 3.1.0, Symfony\UX\LiveComponent\Controller\BatchActionController::__invoke() iterates over the client-supplied actions array and issues a full HttpKernel sub-request for each entry; because the array size is never bounded, an authenticated client can submit a single _batch request containing thousands of actions and exhaust CPU, memory, and database connections on the application server. This issue is fixed in versions 2.36.0 and 3.1.0.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-17 17:26 UTC

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

GitHub_M

References

4 references

URL	Tags
https://github.com/symfony/ux/security/advisories…	x_refsource_CONFIRM
https://github.com/symfony/ux/commit/95e878d5257f…	x_refsource_MISC
https://github.com/symfony/ux/releases/tag/v2.36.0	x_refsource_MISC
https://github.com/symfony/ux/releases/tag/v3.1.0	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
symfony	ux	Affected: >= 3.0.0, < 3.1.0 Affected: >= 2.5.0, < 2.36.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-49209",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-17T17:26:12.348589Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-17T17:26:18.929Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "ux",
          "vendor": "symfony",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.0.0, \u003c 3.1.0"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.5.0, \u003c 2.36.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Symfony UX is a JavaScript ecosystem for Symfony. From 2.5.0 until 2.36.0 and 3.1.0, Symfony\\UX\\LiveComponent\\Controller\\BatchActionController::__invoke() iterates over the client-supplied actions array and issues a full HttpKernel sub-request for each entry; because the array size is never bounded, an authenticated client can submit a single _batch request containing thousands of actions and exhaust CPU, memory, and database connections on the application server. This issue is fixed in versions 2.36.0 and 3.1.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-17T16:02:06.498Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/symfony/ux/security/advisories/GHSA-mm82-c99c-h2cf",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/symfony/ux/security/advisories/GHSA-mm82-c99c-h2cf"
        },
        {
          "name": "https://github.com/symfony/ux/commit/95e878d5257f13d6d652ca95e3ef6bb0934d674f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/symfony/ux/commit/95e878d5257f13d6d652ca95e3ef6bb0934d674f"
        },
        {
          "name": "https://github.com/symfony/ux/releases/tag/v2.36.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/symfony/ux/releases/tag/v2.36.0"
        },
        {
          "name": "https://github.com/symfony/ux/releases/tag/v3.1.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/symfony/ux/releases/tag/v3.1.0"
        }
      ],
      "source": {
        "advisory": "GHSA-mm82-c99c-h2cf",
        "discovery": "UNKNOWN"
      },
      "title": "Symfony UX: Denial of service in symfony/ux-live-component via unbounded batch action requests"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-49209",
    "datePublished": "2026-07-17T16:02:06.498Z",
    "dateReserved": "2026-05-28T03:42:34.340Z",
    "dateUpdated": "2026-07-17T17:26:18.929Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-55877 (GCVE-0-2026-55877)

Vulnerability from cvelistv5 – Published: 2026-07-08 21:32 – Updated: 2026-07-09 14:40

Title

Symfony UX: XSS in symfony/ux-icons via unsanitized SVG content in local files and Iconify on-demand responses

Summary

Symfony UX is a JavaScript ecosystem for Symfony. From 2.17.0 before 2.36.1 and from 3.0.0 before 3.2.0, the ux_icon() Twig function is marked is_safe=['html'] and Icon::toHtml() inlines SVG source verbatim, allowing unsanitized local SVG files or Iconify on-demand JSON body responses containing nested script elements, on* event handlers, or dangerous URL schemes to execute cross-site scripting. This issue is fixed in versions 2.36.1 and 3.2.0.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-09 14:21 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M

References

4 references

URL	Tags
https://github.com/symfony/ux/security/advisories…	x_refsource_CONFIRM
https://github.com/symfony/ux/commit/3a4964ec3700…	x_refsource_MISC
https://github.com/symfony/ux/releases/tag/v2.36.1	x_refsource_MISC
https://github.com/symfony/ux/releases/tag/v3.2.0	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
symfony	ux	Affected: >= 2.17.0, < 2.36.1 Affected: >= 3.0.0, < 3.2.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-55877",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-09T14:21:00.657899Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-09T14:40:25.026Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "ux",
          "vendor": "symfony",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.17.0, \u003c 2.36.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.0.0, \u003c 3.2.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Symfony UX is a JavaScript ecosystem for Symfony. From 2.17.0 before 2.36.1 and from 3.0.0 before 3.2.0, the ux_icon() Twig function is marked is_safe=[\u0027html\u0027] and Icon::toHtml() inlines SVG source verbatim, allowing unsanitized local SVG files or Iconify on-demand JSON body responses containing nested script elements, on* event handlers, or dangerous URL schemes to execute cross-site scripting. This issue is fixed in versions 2.36.1 and 3.2.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-08T21:32:37.407Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/symfony/ux/security/advisories/GHSA-6v8j-33hc-mv84",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/symfony/ux/security/advisories/GHSA-6v8j-33hc-mv84"
        },
        {
          "name": "https://github.com/symfony/ux/commit/3a4964ec3700f0af4e13f7bfbf8bb3174c3e79d1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/symfony/ux/commit/3a4964ec3700f0af4e13f7bfbf8bb3174c3e79d1"
        },
        {
          "name": "https://github.com/symfony/ux/releases/tag/v2.36.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/symfony/ux/releases/tag/v2.36.1"
        },
        {
          "name": "https://github.com/symfony/ux/releases/tag/v3.2.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/symfony/ux/releases/tag/v3.2.0"
        }
      ],
      "source": {
        "advisory": "GHSA-6v8j-33hc-mv84",
        "discovery": "UNKNOWN"
      },
      "title": "Symfony UX: XSS in symfony/ux-icons via unsanitized SVG content in local files and Iconify on-demand responses"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-55877",
    "datePublished": "2026-07-08T21:32:37.407Z",
    "dateReserved": "2026-06-17T16:59:42.759Z",
    "dateUpdated": "2026-07-09T14:40:25.026Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-55878 (GCVE-0-2026-55878)

Vulnerability from cvelistv5 – Published: 2026-07-08 21:30 – Updated: 2026-07-09 14:19

Title

Symfony: Path Traversal in symfony/ux-toolkit Allows Arbitrary File Write and Read via Crafted Recipe Manifest

Summary

Symfony UX is a JavaScript ecosystem for Symfony. From 2.32.0 before 2.36.1 and from 3.0.0 before 3.2.0, the ux:install console command installs files from a recipe kit by copying paths listed in a copy-files map, and because Path::isRelative() accepts paths like ../../../etc, a crafted or compromised kit can write attacker-controlled content to arbitrary locations or read local files outside the recipe directory. This issue is fixed in versions 2.36.1 and 3.2.0.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-09 14:18 UTC

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

GitHub_M

References

4 references

URL	Tags
https://github.com/symfony/ux/security/advisories…	x_refsource_CONFIRM
https://github.com/symfony/ux/commit/7b4ddf3764bf…	x_refsource_MISC
https://github.com/symfony/ux/releases/tag/v2.36.1	x_refsource_MISC
https://github.com/symfony/ux/releases/tag/v3.2.0	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
symfony	ux	Affected: >= 2.32.0, < 2.36.1 Affected: >= 3.0.0, < 3.2.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-55878",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-09T14:18:56.012444Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-09T14:19:07.068Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "ux",
          "vendor": "symfony",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.32.0, \u003c 2.36.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.0.0, \u003c 3.2.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Symfony UX is a JavaScript ecosystem for Symfony. From 2.32.0 before 2.36.1 and from 3.0.0 before 3.2.0, the ux:install console command installs files from a recipe kit by copying paths listed in a copy-files map, and because Path::isRelative() accepts paths like ../../../etc, a crafted or compromised kit can write attacker-controlled content to arbitrary locations or read local files outside the recipe directory. This issue is fixed in versions 2.36.1 and 3.2.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-08T21:30:33.816Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/symfony/ux/security/advisories/GHSA-p9xj-fpr2-jf2q",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/symfony/ux/security/advisories/GHSA-p9xj-fpr2-jf2q"
        },
        {
          "name": "https://github.com/symfony/ux/commit/7b4ddf3764bf269a1b5fde5bf03c4bce568694e4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/symfony/ux/commit/7b4ddf3764bf269a1b5fde5bf03c4bce568694e4"
        },
        {
          "name": "https://github.com/symfony/ux/releases/tag/v2.36.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/symfony/ux/releases/tag/v2.36.1"
        },
        {
          "name": "https://github.com/symfony/ux/releases/tag/v3.2.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/symfony/ux/releases/tag/v3.2.0"
        }
      ],
      "source": {
        "advisory": "GHSA-p9xj-fpr2-jf2q",
        "discovery": "UNKNOWN"
      },
      "title": "Symfony: Path Traversal in symfony/ux-toolkit Allows Arbitrary File Write and Read via Crafted Recipe Manifest"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-55878",
    "datePublished": "2026-07-08T21:30:33.816Z",
    "dateReserved": "2026-06-17T16:59:42.759Z",
    "dateUpdated": "2026-07-09T14:19:07.068Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-47946 (GCVE-0-2025-47946)

Vulnerability from cvelistv5 – Published: 2025-05-19 19:25 – Updated: 2025-05-20 13:01

Title

symfony/ux-live-component and symfony/ux-twig-component vulnerable to unsanitized HTML attribute injection via ComponentAttributes

Summary

Symfony UX is an initiative and set of libraries to integrate JavaScript tools into applications. Prior to version 2.25.1, rendering `{{ attributes }}` or using any method that returns a `ComponentAttributes` instance (e.g. `only()`, `defaults()`, `without()`) ouputs attribute values directly without escaping. If these values are unsafe (e.g. contain user input), this can lead to HTML attribute injection and XSS vulnerabilities. The issue is fixed in version `2.25.1` of `symfony/ux-twig-component` Those who use `symfony/ux-live-component` must also update it to `2.25.1` to benefit from the fix, as it reuses the `ComponentAttributes` class internally. As a workaround, avoid rendering `{{ attributes }}` or derived objects directly if it may contain untrusted values. Instead, use `{{ attributes.render('name') }}` for safe output of individual attributes.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-05-20 13:01 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M

References

2 references

URL	Tags
https://github.com/symfony/ux/security/advisories…	x_refsource_CONFIRM
https://github.com/symfony/ux/commit/b5d1c85995c1…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
symfony	ux	Affected: < 2.25.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-47946",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-20T13:01:03.682812Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-20T13:01:10.237Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "ux",
          "vendor": "symfony",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.25.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Symfony UX is an initiative and set of libraries to integrate JavaScript tools into applications. Prior to version 2.25.1, rendering `{{ attributes }}` or using any method that returns a `ComponentAttributes` instance (e.g. `only()`, `defaults()`, `without()`) ouputs attribute values directly without escaping. If these values are unsafe (e.g. contain user input), this can lead to HTML attribute injection and XSS vulnerabilities. The issue is fixed in version `2.25.1` of `symfony/ux-twig-component` Those who use `symfony/ux-live-component` must also update it to `2.25.1` to benefit from the fix, as it reuses the `ComponentAttributes` class internally. As a workaround, avoid rendering `{{ attributes }}` or derived objects directly if it may contain untrusted values.\nInstead, use `{{ attributes.render(\u0027name\u0027) }}` for safe output of individual attributes."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-19T19:25:19.350Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/symfony/ux/security/advisories/GHSA-5j3w-5pcr-f8hg",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/symfony/ux/security/advisories/GHSA-5j3w-5pcr-f8hg"
        },
        {
          "name": "https://github.com/symfony/ux/commit/b5d1c85995c128cb926d47a96cfbfbd500b643a8",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/symfony/ux/commit/b5d1c85995c128cb926d47a96cfbfbd500b643a8"
        }
      ],
      "source": {
        "advisory": "GHSA-5j3w-5pcr-f8hg",
        "discovery": "UNKNOWN"
      },
      "title": "symfony/ux-live-component and symfony/ux-twig-component vulnerable to unsanitized HTML attribute injection via ComponentAttributes"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-47946",
    "datePublished": "2025-05-19T19:25:19.350Z",
    "dateReserved": "2025-05-14T10:32:43.530Z",
    "dateUpdated": "2025-05-20T13:01:10.237Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Find a vulnerability

Search criteria

20 vulnerabilities found for ux by symfony

CVE-2026-49216 (GCVE-0-2026-49216)

CVE-2026-49215 (GCVE-0-2026-49215)

CVE-2026-49212 (GCVE-0-2026-49212)

CVE-2026-49211 (GCVE-0-2026-49211)

CVE-2026-49210 (GCVE-0-2026-49210)

CVE-2026-49209 (GCVE-0-2026-49209)

CVE-2026-49208 (GCVE-0-2026-49208)

CVE-2026-55878 (GCVE-0-2026-55878)

CVE-2026-55877 (GCVE-0-2026-55877)

CVE-2025-47946 (GCVE-0-2025-47946)

CVE-2026-49215 (GCVE-0-2026-49215)

CVE-2026-49216 (GCVE-0-2026-49216)

CVE-2026-49211 (GCVE-0-2026-49211)

CVE-2026-49208 (GCVE-0-2026-49208)

CVE-2026-49210 (GCVE-0-2026-49210)

CVE-2026-49212 (GCVE-0-2026-49212)

CVE-2026-49209 (GCVE-0-2026-49209)

CVE-2026-55877 (GCVE-0-2026-55877)

CVE-2026-55878 (GCVE-0-2026-55878)

CVE-2025-47946 (GCVE-0-2025-47946)