Symfony UX is a JavaScript ecosystem for Symfony. From 2.2.0 until 2.36.0 and 3.1.0, the Stimulus controller in symfony/ux-autocomplete renders AJAX response items in _createAutocompleteWithRemoteData() by interpolating the text field into HTML template literals (<div>${item[labelField]}</div>) rather than text, allowing attacker-controlled markup from user-supplied dropdown values to execute in the browser of any user who opens an autocomplete widget backed by the same data. This issue is fixed in versions 2.36.0 and 3.1.0.
References
| Link | Resource |
|---|---|
| https://github.com/symfony/ux/commit/842ae54bc74de389299f975f01aafae272cb0019 | Patch |
| https://github.com/symfony/ux/releases/tag/v2.36.0 | Release Notes |
| https://github.com/symfony/ux/releases/tag/v3.1.0 | Release Notes |
| https://github.com/symfony/ux/security/advisories/GHSA-mwqm-4fw3-cjvr | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
20 Jul 2026, 16:54
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/symfony/ux/commit/842ae54bc74de389299f975f01aafae272cb0019 - Patch | |
| References | () https://github.com/symfony/ux/releases/tag/v2.36.0 - Release Notes | |
| References | () https://github.com/symfony/ux/releases/tag/v3.1.0 - Release Notes | |
| References | () https://github.com/symfony/ux/security/advisories/GHSA-mwqm-4fw3-cjvr - Vendor Advisory | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.4 |
| CPE | cpe:2.3:a:symfony:ux:3.0.0:*:*:*:*:*:*:* cpe:2.3:a:symfony:ux:*:*:*:*:*:*:*:* |
|
| First Time |
Symfony
Symfony ux |
17 Jul 2026, 17:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-07-17 17:17
Updated : 2026-07-21 03:16
NVD link : CVE-2026-49216
Mitre link : CVE-2026-49216
CVE.ORG link : CVE-2026-49216
JSON object : View
Products Affected
symfony
- ux
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')