Read the docs
TI-2026-24375 Aliases CVE-2026-31822GHSA-vgh8-c6fp-7gcg

Sylius has a XSS vulnerability in checkout login form

Priority LOW 29CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Sylius is an Open Source eCommerce Framework on Symfony. A cross-site scripting (XSS) vulnerability exists in the shop checkout login form handled by the ApiLoginController Stimulus controller. When a login attempt fails, AuthenticationFailureHandler returns a JSON response whose message field is rendered into the DOM using innerHTML, allowing any HTML or JavaScript in that value to be parsed and executed by the browser. The issue is fixed in versions: 2.0.16, 2.1.12, 2.2.3 and above.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00214 11th percentileScored 2026-11-07
Fix Fixed Sylius (Sylius): 2.2.3, 2.1.12, 2.0.16sylius/sylius (Packagist): 2.0.16, 2.1.12, 2.2.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SyliusSylius2.2.0 to before 2.2.3; 2.1.0 to before 2.1.12; 2.0.0 to before 2.0.162.2.3, 2.1.12, 2.0.16Patch availableCNA
—sylius/sylius (Packagist)2.0.0 to before 2.0.162.0.16Patch availableGHSA-vgh8-c6fp-7gcg
—sylius/sylius (Packagist)2.1.0 to before 2.1.122.1.12Patch availableGHSA-vgh8-c6fp-7gcg
—sylius/sylius (Packagist)2.2.0 to before 2.2.32.2.3Patch availableGHSA-vgh8-c6fp-7gcg
  • Sylius VendorSylius Affected 2.2.0 to before 2.2.3; 2.1.0 to before 2.1.12; 2.0.0 to before 2.0.16 Fixed in 2.2.3, 2.1.12, 2.0.16 Patch available CNA
  • sylius/sylius (Packagist) Vendor— Affected 2.0.0 to before 2.0.16 Fixed in 2.0.16 Patch available GHSA-vgh8-c6fp-7gcg
  • sylius/sylius (Packagist) Vendor— Affected 2.1.0 to before 2.1.12 Fixed in 2.1.12 Patch available GHSA-vgh8-c6fp-7gcg
  • sylius/sylius (Packagist) Vendor— Affected 2.2.0 to before 2.2.3 Fixed in 2.2.3 Patch available GHSA-vgh8-c6fp-7gcg

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:sylius:sylius:*:*:*:*:*:*:*:*2.0.0 to before 2.0.16; 2.1.0 to before 2.1.12; 2.2.0 to before 2.2.3VulnerableSylius
  • cpe:2.3:a:sylius:sylius:*:*:*:*:*:*:*:* Versions 2.0.0 to before 2.0.16; 2.1.0 to before 2.1.12; 2.2.0 to before 2.2.3 Vulnerable ·Sylius

Remediation

  • Fix · CNA Sylius (Sylius) Fixed in 2.2.3, 2.1.12, 2.0.16
  • Fix · GHSA-vgh8-c6fp-7gcg sylius/sylius (Packagist) Fixed in 2.0.16 Advisory →
  • Fix · GHSA-vgh8-c6fp-7gcg sylius/sylius (Packagist) Fixed in 2.1.12 Advisory →
  • Fix · GHSA-vgh8-c6fp-7gcg sylius/sylius (Packagist) Fixed in 2.2.3 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-31822
  2. 2026-10-03 Alias added: GHSA-vgh8-c6fp-7gcg

References

Advisory 2

Other 1

  • TI-2026-24374 Sylius is Missing Authorization in API v2 Add Item Endpoint CVSS 4.0MEDIUM 6.9
  • TI-2022-08557 Insufficient Session Expiration in Sylius CVSS 3.1HIGH 8.2
  • TI-2026-24378 Sylius has a DQL Injection via API Order Filters CVSS 3.1MEDIUM 5.3
  • TI-2024-19437 Sylius 1.12.13 is vulnerable to Cross Site Scripting (XSS) via the "Province" field in Address Book. CVSS 3.1MEDIUM 6.4
  • TI-2022-08563 Basic Cross-site Scripting and Unrestricted Upload of File with Dangerous Type in Sylius CVSS 3.1MEDIUM 6.1
  • TI-2026-24377 Sylius has a Promotion Usage Limit Bypass via Race Condition CVSS 3.1HIGH 8.2
See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences