PT-2026-51051 · Packagist · Symfony/Ux-Live-Component

Published 2026-06-19 · Updated 2026-06-19 · CVE-2026-49210

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions Symfony UX LiveComponent versions prior to 2.x Symfony UX LiveComponent versions prior to 3.x

Description The createHtml() function in SymfonyUXLiveComponentUtilChildComponentPartialRenderer interpolates the $childTag variable directly into the HTML output as a tag name without proper escaping or validation. This variable is derived from client-controlled JSON (children[id].tag) processed by LiveComponentSubscriber and InterceptChildComponentRenderSubscriber. An attacker accessing the Live Component endpoint can inject arbitrary HTML, such as <script> tags, during the re-render of a Live Component containing at least one child component. By default, the endpoint is protected by an Accept: application/vnd.live-component+html header check; however, the issue is exploitable if CORS policies are relaxed to allow this header from untrusted origins or if a same-origin XSS is already present.

Recommendations Update to the patched version of the 2.x branch. Update to the patched version of the 3.x branch.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-49210

GHSA-38X5-RCV4-XF7X

Affected Products

Symfony/Ux-Live-Component

References · 6

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/ux-live-component/CVE-2026-49210.yaml · Exploit
• https://osv.dev/vulnerability/GHSA-38x5-rcv4-xf7x · Vendor Advisory
• https://github.com/symfony/ux/security/advisories/GHSA-38x5-rcv4-xf7x · Note
• https://github.com/symfony/ux/commit/fbc5e9a1bda7e4556be21bb1d970f382760ed9a9 · Note
• https://github.com/symfony/ux · Note
• https://twitter.com/dailycve/status/2068098258769940755 · Twitter Post