CVE-2026-49216

Symfony UX is a JavaScript ecosystem for Symfony. From 2.2.0 until 2.36.0 and 3.1.0, the Stimulus controller in symfony/ux-autocomplete renders AJAX response items in _createAutocompleteWithRemoteData() by interpolating the text field into HTML template literals (<div>${item[labelField]}</div>) rather than text, allowing attacker-controlled markup from user-supplied dropdown values to execute in the browser of any user who opens an autocomplete widget backed by the same data. This issue is fixed in versions 2.36.0 and 3.1.0.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/symfony/ux/commit/842ae54bc74de389299f975f01aafae272cb0019	Patch
https://github.com/symfony/ux/releases/tag/v2.36.0	Release Notes
https://github.com/symfony/ux/releases/tag/v3.1.0	Release Notes
https://github.com/symfony/ux/security/advisories/GHSA-mwqm-4fw3-cjvr	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:symfony:ux::::::::
	cpe:2.3:a:symfony:ux:3.0.0:::::::*

History

24 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Symfony UX es un ecosistema JavaScript para Symfony. Desde la versión 2.2.0 hasta la 2.36.0 y la 3.1.0, el controlador Stimulus en symfony/ux-autocomplete renderiza elementos de respuesta AJAX en _createAutocompleteWithRemoteData() interpolando el campo de texto en literales de plantilla HTML ([div]${item[labelField]}[/div]) en lugar de como texto, permitiendo que marcado controlado por el atacante, proveniente de valores de menú desplegable proporcionados por el usuario, se ejecute en el navegador de cualquier usuario que abra un widget de autocompletado respaldado por los mismos datos. Este problema está solucionado en las versiones 2.36.0 y 3.1.0.

Information

Published : 2026-07-17 17:17

Updated : 2026-10-24 20:10

NVD link : CVE-2026-49216

Mitre link : CVE-2026-49216

CVE.ORG link : CVE-2026-49216

JSON object : View

Products Affected

symfony

ux

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2026-49216", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-49216", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-21T01:43:58.784121Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "symfony", "product": "ux", "versions": [{"status": "affected", "version": ">= 3.0.0, < 3.1.0"}, {"status": "affected", "version": "< 2.36.0"}]}]}], "published": "2026-07-17T17:17:16.190", "references": [{"url": "https://github.com/symfony/ux/commit/842ae54bc74de389299f975f01aafae272cb0019", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/symfony/ux/releases/tag/v2.36.0", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/symfony/ux/releases/tag/v3.1.0", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/symfony/ux/security/advisories/GHSA-mwqm-4fw3-cjvr", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Symfony UX is a JavaScript ecosystem for Symfony. From 2.2.0 until 2.36.0 and 3.1.0, the Stimulus controller in symfony/ux-autocomplete renders AJAX response items in _createAutocompleteWithRemoteData() by interpolating the text field into HTML template literals (<div>${item[labelField]}</div>) rather than text, allowing attacker-controlled markup from user-supplied dropdown values to execute in the browser of any user who opens an autocomplete widget backed by the same data. This issue is fixed in versions 2.36.0 and 3.1.0."}, {"lang": "es", "value": "Symfony UX es un ecosistema JavaScript para Symfony. Desde la versi\u00f3n 2.2.0 hasta la 2.36.0 y la 3.1.0, el controlador Stimulus en symfony/ux-autocomplete renderiza elementos de respuesta AJAX en _createAutocompleteWithRemoteData() interpolando el campo de texto en literales de plantilla HTML ([div]${item[labelField]}[/div]) en lugar de como texto, permitiendo que marcado controlado por el atacante, proveniente de valores de men\u00fa desplegable proporcionados por el usuario, se ejecute en el navegador de cualquier usuario que abra un widget de autocompletado respaldado por los mismos datos. Este problema est\u00e1 solucionado en las versiones 2.36.0 y 3.1.0."}], "lastModified": "2026-10-24T20:10:00.137", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:symfony:ux:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B81A2154-C637-4A34-A6DB-40F68F98AAE8", "versionEndExcluding": "2.36.0", "versionStartIncluding": "2.2.0"}, {"criteria": "cpe:2.3:a:symfony:ux:3.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3C0974BE-BF17-497A-BA94-8B89B2BE9788"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}