CVE-2026-49216Medium▾ Sunlitsymfony/ux-autocomplete: XSS via unescaped AJAX response data
▾ Sunlit zone — Low / medium · no exploitation signal
impact 27.5 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 1.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
0.2%
0.2% → 0.3%
The Stimulus controller shipped with symfony/ux-autocomplete renders AJAX response items into the dropdown by interpolating the text field directly into HTML template literals (<div>${item[labelField]}</div>) inside _createAutocompleteWithRemoteData(). The value is parsed as HTML rather than text, so any markup contained in the AJAX response is executed by the browser.
When the dropdown values are derived from user-supplied content, an attacker can craft a string that triggers stored XSS in the browser of any other user who later opens a page containing an autocomplete widget backed by the same data.
The option and item renderers used in _createAutocompleteWithRemoteData() now use TomSelect's escape helper to HTML-escape the value by default. Endpoints that legitimately return HTML (for example, to highlight the search term) can opt back in to the previous behavior by setting options_as_html: true. The AutocompleteChoiceTypeExtension normalizer that previously forced options_as_html=false when autocomplete_url was set has been dropped so the opt-in is reachable from the form layer.
The patch for this issue is available here for branch 2.x (and forward-ported to 3.x).
Symfony would like to thank Alex Ashkov for reporting the issue and Hugo Alliaume for providing the fix.
symfony/ux-autocomplete >= 2.2.0, < 2.36.0symfony/ux-autocomplete >= 3.0.0, < 3.1.0Upgrade to a patched release:
symfony/ux-autocomplete 2.36.0symfony/ux-autocomplete 3.1.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-48761MediumSymfony: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes
CVE-2026-49210Mediumsymfony/ux-live-component: XSS via attacker-controlled child component tag
CVE-2026-49211Mediumsymfony/ux-autocomplete: Information exposure via unescaped LIKE wildcards in EntitySearchUtil
CVE-2026-55877Medium· 6.1symfony/ux-icons: XSS via unsanitized SVG content in local files and Iconify on-demand responses
CVE-2026-108082High· 8.7Symfony is a PHP framework for web and console applications and a set of reusable PHP components
CVE-2026-109413High· 8.7In Symfony YAML prior to versions 5.4.54, 6.4.45, 7.4.18, and 8.1.6, Yaml\Parser::lexInlineStructure() recursed through lexInlineMapping() and lexInlineSequence() for every { and [ of an inline collection, without entering the nesting le…