CVE-2026-49216

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-49216
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-49216.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-49216
Aliases
Published
2026-07-17T16:15:34Z
Modified
2026-10-21T02:30:24Z
Severity
  • 5.1 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N CVSS Calculator
Summary
Symfony UX: XSS in symfony/ux-autocomplete via unescaped AJAX response data
Details

Symfony UX is a JavaScript ecosystem for Symfony. From 2.2.0 until 2.36.0 and 3.1.0, the Stimulus controller in symfony/ux-autocomplete renders AJAX response items in _createAutocompleteWithRemoteData() by interpolating the text field into HTML template literals (

${item[labelField]}
) rather than text, allowing attacker-controlled markup from user-supplied dropdown values to execute in the browser of any user who opens an autocomplete widget backed by the same data. This issue is fixed in versions 2.36.0 and 3.1.0.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-79"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49216.json"
}
References

Affected packages

Git / github.com/symfony/ux

Affected ranges

Type
GIT
Repo
https://github.com/symfony/ux
Events
Introduced
9b4622ea7cbb9b4223d292fc3f8e8d2352f967c0
Fixed
5ccec9746faa28d79a87138042174c3853d5702b
Introduced
3cef8e0d9557bbde60c3f1bfd2cbb1004af7fc9a
Fixed
842ae54bc74de389299f975f01aafae272cb0019
Fixed
4c883fdb0f0e7ea577f851bd457024f7e88788c9
Database specific
Show details 
{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:symfony:ux:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "2.2.0"
                },
                {
                    "fixed":  "2.36.0"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:symfony:ux:3.0.0:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "3.0.0"
                },
                {
                    "last_affected":  "3.0.0"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "range":  [
                {
                    "fixed":  "842ae54bc74de389299f975f01aafae272cb0019"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "original_tag":  "v2.36.0",
            "range":  [
                {
                    "fixed":  "5ccec9746faa28d79a87138042174c3853d5702b"
                }
            ],
            "source":  "REFERENCES_TAG"
        },
        {
            "original_tag":  "v3.1.0",
            "range":  [
                {
                    "fixed":  "4c883fdb0f0e7ea577f851bd457024f7e88788c9"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Affected versions

3.*
3.0.0
v2.*
v2.10.0
v2.11.0
v2.11.1
v2.11.2
v2.12.0
v2.13.0
v2.13.1
v2.13.2
v2.13.3
v2.14.0
v2.14.1
v2.14.2
v2.15.0
v2.16.0
v2.17.0
v2.18.0
v2.18.1
v2.19.0
v2.19.1
v2.19.2
v2.19.3
v2.2.0
v2.20.0
v2.21.0
v2.22.0
v2.22.1
v2.23.0
v2.24.0
v2.25.0
v2.25.1
v2.25.2
v2.26.0
v2.26.1
v2.27.0
v2.28.0
v2.28.1
v2.28.2
v2.29.0
v2.29.1
v2.29.2
v2.3.0
v2.30.0
v2.31.0
v2.32.0
v2.33.0
v2.34.0
v2.35.0
v2.4.0
v2.5.0
v2.6.0
v2.6.1
v2.7.0
v2.7.1
v2.8.0
v2.8.1
v2.9.0
v2.9.1
v3.*
v3.0.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-49216.json"