PT-2026-24476 · Sylius · Sylius

Bartłomiej Nowiński · Published 2026-03-10 · Updated 2026-03-11 · CVE-2026-31822

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Sylius versions prior to 2.0.16 Sylius versions prior to 2.1.12 Sylius versions prior to 2.2.3

Description Sylius, an Open Source eCommerce Framework on Symfony, contains a cross-site scripting (XSS) issue in the shop checkout login form. The ApiLoginController Stimulus controller handles the vulnerability. When a login attempt fails, the AuthenticationFailureHandler returns a JSON response. The message field within this response is rendered into the Document Object Model (DOM) using innerHTML, which allows any HTML or JavaScript present in the value to be parsed and executed by the browser.

Recommendations Update Sylius to version 2.0.16 or later. Update Sylius to version 2.1.12 or later. Update Sylius to version 2.2.3 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-31822

GHSA-VGH8-C6FP-7GCG

Affected Products

Sylius

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31822.json · Exploit
• https://github.com/Sylius/Sylius/security/advisories/GHSA-vgh8-c6fp-7gcg · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-31822 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31822 · Security Note
• https://osv.dev/vulnerability/GHSA-vgh8-c6fp-7gcg · Vendor Advisory
• https://github.com/Sylius/Sylius · Note
• https://twitter.com/CVEnew/status/2031504079940165834 · Twitter Post