GHSA-38x5-rcv4-xf7x
Suggest an improvement- Source
- https://github.com/advisories/GHSA-38x5-rcv4-xf7x
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-38x5-rcv4-xf7x/GHSA-38x5-rcv4-xf7x.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-38x5-rcv4-xf7x
- Aliases
- Published
- 2026-06-19T19:34:49Z
- Modified
- 2026-09-10T03:51:07Z
- Severity
-
- 5.1 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N CVSS Calculator
- Summary
- symfony/ux-live-component: XSS via attacker-controlled child component tag
- Details
-
Description
Symfony\UX\LiveComponent\Util\ChildComponentPartialRenderer::createHtml()interpolates the$childTagargument directly into the HTML output as a tag name, without escaping or validation. The value originates from client-controlled JSON (children[id].tag) parsed byLiveComponentSubscriberand propagated throughInterceptChildComponentRenderSubscriber, so an attacker who can reach the Live Component endpoint can inject arbitrary HTML, including<script>tags, on any re-render of a Live Component that contains at least one child component.In the default configuration, the Live Component endpoint is gated by an
Accept: application/vnd.live-component+htmlrequest-header check that cannot be set cross-origin without a CORS preflight, so the issue is primarily a defense-in-depth gap. It becomes directly exploitable on applications that have relaxed CORS to allow this header from untrusted origins, or that have been pivoted from another same-origin XSS.Resolution
ChildComponentPartialRenderernow validates$childTagagainst a strict HTML tag-name regex before interpolating it, and rejects any value that doesn't match. Anything that wouldn't be a valid HTML tag is dropped before reaching the response.The patch for this issue is available here for branch 2.x (and forward-ported to 3.x).
Credits
Symfony would like to thank Pascal Cescon for reporting the issue and Hugo Alliaume for providing the fix.
- Database specific
{ "cwe_ids": [ "CWE-79" ], "github_reviewed": true, "github_reviewed_at": "2026-06-19T19:34:49Z", "nvd_published_at": null, "severity": "MODERATE" }- References
Affected packages
Packagist / symfony/ux-live-component
Package
- Name
- symfony/ux-live-component
- Purl
- pkg:composer/symfony/ux-live-component
Affected versions
v2.*
Packagist / symfony/ux-live-component
Package
- Name
- symfony/ux-live-component
- Purl
- pkg:composer/symfony/ux-live-component