CyberRota Analysis
AI-GeneratedThe Symfony UX JavaScript ecosystem is vulnerable due to improper handling of user-supplied dropdown values in the Stimulus controller, allowing attacker-controlled markup to execute in the browser when users interact with the autocomplete widget. This could lead to cross-site scripting (XSS) attacks, potentially compromising user data and session integrity. Developers using affected versions (2.2.0 to 2.36.0 and 3.1.0) should prioritize upgrading to the patched versions to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Symfony UX is a JavaScript ecosystem for Symfony. From 2.2.0 until 2.36.0 and 3.1.0, the Stimulus controller in symfony/ux-autocomplete renders AJAX response items in _createAutocompleteWithRemoteData() by interpolating the text field into HTML template literals (<div>${item[labelField]}</div>) rather than text, allowing attacker-controlled markup from user-supplied dropdown values to execute in the browser of any user who opens an autocomplete widget backed by the same data. This issue is fixed in versions 2.36.0 and 3.1.0.
Related CVEs
Other vulnerabilities affecting the same vendor(s)