Read the docs
TI-2026-36417 Aliases CVE-2026-49216GHSA-mwqm-4fw3-cjvr

Symfony UX: XSS in symfony/ux-autocomplete via unescaped AJAX response data

Priority LOW 23CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Symfony UX is a JavaScript ecosystem for Symfony. From 2.2.0 until 2.36.0 and 3.1.0, the Stimulus controller in symfony/ux-autocomplete renders AJAX response items in _createAutocompleteWithRemoteData() by interpolating the text field into HTML template literals (<div>${item[labelField]}</div>) rather than text, allowing attacker-controlled markup from user-supplied dropdown values to execute in the browser of any user who opens an autocomplete widget backed by the same data. This issue is fixed in versions 2.36.0 and 3.1.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00312 24th percentileScored 2026-11-07
Fix Fixed ux (symfony): 3.1.0, 2.36.0symfony/ux-autocomplete (Packagist): 2.36.0, 3.1.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
symfonyux3.0.0 to before 3.1.0; before 2.36.03.1.0, 2.36.0Patch availableCNA
—symfony/ux-autocomplete (Packagist)2.2.0 to before 2.36.02.36.0Patch availableGHSA-mwqm-4fw3-cjvr
—symfony/ux-autocomplete (Packagist)3.0.0 to before 3.1.03.1.0Patch availableGHSA-mwqm-4fw3-cjvr
  • ux Vendorsymfony Affected 3.0.0 to before 3.1.0; before 2.36.0 Fixed in 3.1.0, 2.36.0 Patch available CNA
  • symfony/ux-autocomplete (Packagist) Vendor— Affected 2.2.0 to before 2.36.0 Fixed in 2.36.0 Patch available GHSA-mwqm-4fw3-cjvr
  • symfony/ux-autocomplete (Packagist) Vendor— Affected 3.0.0 to before 3.1.0 Fixed in 3.1.0 Patch available GHSA-mwqm-4fw3-cjvr

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:symfony:ux:*:*:*:*:*:*:*:*2.2.0 to before 2.36.0Vulnerablesymfony
cpe:2.3:a:symfony:ux:3.0.0:*:*:*:*:*:*:*3.0.0Vulnerablesymfony
  • cpe:2.3:a:symfony:ux:*:*:*:*:*:*:*:* Versions 2.2.0 to before 2.36.0 Vulnerable ·symfony
  • cpe:2.3:a:symfony:ux:3.0.0:*:*:*:*:*:*:* Versions 3.0.0 Vulnerable ·symfony

Remediation

  • Fix · CNA ux (symfony) Fixed in 3.1.0, 2.36.0
  • Fix · GHSA-mwqm-4fw3-cjvr symfony/ux-autocomplete (Packagist) Fixed in 2.36.0 Advisory →
  • Fix · GHSA-mwqm-4fw3-cjvr symfony/ux-autocomplete (Packagist) Fixed in 3.1.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-49216
  2. 2026-10-03 Alias added: GHSA-mwqm-4fw3-cjvr

References

Patch 1

Advisory 1

Other 4

  • TI-2026-36412 Symfony UX: Information exposure via unescaped LIKE wildcards in EntitySearchUtil CVSS 4.0MEDIUM 6.9
  • TI-2026-36409 Symfony UX: Format-less date LiveProps parsed with the permissive DateTime constructor CVSS 4.0MEDIUM 6.9
  • TI-2026-36413 Symfony UX: LiveComponentHydrator HMAC checksum lacks component and slot binding CVSS 4.0MEDIUM 6.9
  • TI-2026-40330 Symfony UX: XSS in symfony/ux-icons via unsanitized SVG content in local files and Iconify on-demand responses CVSS 3.1MEDIUM 6.1
  • TI-2026-36410 Symfony UX: Denial of service in symfony/ux-live-component via unbounded batch action requests CVSS 4.0MEDIUM 5.3
  • TI-2026-36411 Symfony UX: XSS in symfony/ux-live-component via attacker-controlled child component tag CVSS 4.0LOW 2.3
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences