Symfony UX is a JavaScript ecosystem for Symfony. From 2.2.0 until 2.36.0 and 3.1.0, the Stimulus controller in symfony/ux-autocomplete renders AJAX response items in _createAutocompleteWithRemoteDat…
Medium CVSS 5.4
Summary
Symfony UX is a JavaScript ecosystem for Symfony. From 2.2.0 until 2.36.0 and 3.1.0, the Stimulus controller in symfony/ux-autocomplete renders AJAX response items in _createAutocompleteWithRemoteData() by interpolating the text field into HTML template literals (<div>${item[labelField]}</div>) rather than text, allowing attacker-controlled markup from user-supplied dropdown values to execute in the browser of any user who opens an autocomplete widget backed by the same data. This issue is fixe…
In-depth triage · Auto channel
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Affected products
- :
Sources
- NVD DATABASE
Original Links
- https://github.com/symfony/ux/commit/842ae54bc74de389299f975f01aafae272cb0019 Patch
- https://github.com/symfony/ux/releases/tag/v2.36.0 Release Notes
- https://github.com/symfony/ux/releases/tag/v3.1.0 Release Notes
- https://github.com/symfony/ux/security/advisories/GHSA-mwqm-4fw3-cjvr Vendor Advisory
Timeline
- nvd_ingest NVD