PT-2026-24477 · Sylius+2 · Sylius+2

Whiteov3Rflow

·

Published

2026-03-10

·

Updated

2026-03-11

·

CVE-2026-31823

CVSS v3.1

4.8

Medium

VectorAV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions Sylius versions 1.9.12 through 2.2.3
Description Sylius, an Open Source eCommerce Framework on Symfony, contains an authenticated stored cross-site scripting (XSS) issue in multiple areas of the shop frontend and admin panel. This is due to unsanitized entity names being rendered as raw HTML. Specifically, the issue affects shop breadcrumbs (shared/breadcrumbs.html.twig), the admin product taxon picker (ProductTaxonTreeController.js), and admin autocomplete fields (Tom Select). A malicious entity name, such as a taxon name containing <img src=x onerror=alert('XSS')>, can be injected and executed as JavaScript. An authenticated administrator can inject arbitrary HTML or JavaScript via entity names, which is then persistently rendered for all users. The vulnerable code interpolates data directly into HTML templates without proper escaping. The issue impacts the rendering of labels in breadcrumbs, the name variable in the admin taxon picker, and entity names displayed in autocomplete fields.
Recommendations Update to Sylius version 1.9.12 or later. Update to Sylius version 1.10.16 or later. Update to Sylius version 1.11.17 or later. Update to Sylius version 1.12.23 or later. Update to Sylius version 1.13.15 or later. Update to Sylius version 1.14.18 or later. Update to Sylius version 2.0.16 or later. Update to Sylius version 2.1.12 or later. Update to Sylius version 2.2.3 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-31823
GHSA-MX4Q-XXC9-PF5Q

Affected Products

Sylius
Symfony
Tom Select