CVE-2026-49210 Details
Description
Symfony UX is a JavaScript ecosystem for Symfony. From 2.8.0 until 2.36.0 and 3.1.0, Symfony\UX\LiveComponent\Util\ChildComponentPartialRenderer::createHtml() interpolates the client-controlled children[id].tag value from LiveComponentSubscriber and InterceptChildComponentRenderSubscriber directly into HTML as a tag name without escaping or validation, allowing arbitrary HTML, including <script> tags, on any Live Component re-render that contains at least one child component. This issue is fixed in versions 2.36.0 and 3.1.0.
A cross-site scripting vulnerability has been identified in Symfony UX Live Component versions 2.8.0 prior to 2.36.0 and 3.0.0 prior to 3.1.0. The issue arises in the ChildComponentPartialRenderer's createHtml() method, where client-controlled child component tag values are interpolated directly into the HTML output as tag names, without proper escaping or validation. This flaw allows the injection of arbitrary HTML, including script tags, into the rendered output of Live Components that contain child components. The vulnerability can be exploited by sending a request to the Live Component endpoint with a malicious tag value.
Users can upgrade to Symfony UX Live Component versions 2.36.0 or 3.1.0, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 17, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| symfony ux | >= 2.8.0, < 2.36.0 3.0.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 20, 2026 | Initial Analysis | [email protected] |
| Jul 17, 2026 | New CVE Received | [email protected] |
| Jul 17, 2026 | CVE Modified | CISA-ADP |