CyberRota Analysis
AI-GeneratedThe vulnerability affects the Symfony UX JavaScript ecosystem, specifically in the handling of client-controlled input within the LiveComponent rendering process, where unvalidated tag names can lead to the injection of arbitrary HTML, including potentially malicious scripts. This could result in cross-site scripting (XSS) attacks on applications utilizing affected versions from 2.8.0 to 2.36.0 and 3.1.0. Developers and security teams using these versions should prioritize upgrading to the patched releases to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Symfony UX is a JavaScript ecosystem for Symfony. From 2.8.0 until 2.36.0 and 3.1.0, Symfony\UX\LiveComponent\Util\ChildComponentPartialRenderer::createHtml() interpolates the client-controlled children[id].tag value from LiveComponentSubscriber and InterceptChildComponentRenderSubscriber directly into HTML as a tag name without escaping or validation, allowing arbitrary HTML, including <script> tags, on any Live Component re-render that contains at least one child component. This issue is fixed in versions 2.36.0 and 3.1.0.
Related CVEs
Other vulnerabilities affecting the same vendor(s)