PT-2026-24476 · Sylius · Sylius

Bartłomiej Nowiński · Publicado 2026-03-10 · Atualizado 2026-03-11 · CVE-2026-31822

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Sylius versions prior to 2.0.16 Sylius versions prior to 2.1.12 Sylius versions prior to 2.2.3

Description Sylius, an Open Source eCommerce Framework on Symfony, contains a cross-site scripting (XSS) issue in the shop checkout login form. The ApiLoginController Stimulus controller handles the vulnerability. When a login attempt fails, the AuthenticationFailureHandler returns a JSON response. The message field within this response is rendered into the Document Object Model (DOM) using innerHTML, which allows any HTML or JavaScript present in the value to be parsed and executed by the browser.

Recommendations Update Sylius to version 2.0.16 or later. Update Sylius to version 2.1.12 or later. Update Sylius to version 2.2.3 or later.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-31822

GHSA-VGH8-C6FP-7GCG

Produtos afetados

Sylius

Referências · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31822.json · Exploit
• https://github.com/Sylius/Sylius · Nota
• https://github.com/Sylius/Sylius/security/advisories/GHSA-vgh8-c6fp-7gcg · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2031504079940165834 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-31822 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-31822 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-vgh8-c6fp-7gcg · Aviso do Fabricante