PT-2026-51055 · Symfony · Ux-Autocomplete

Published 2026-06-19 · Updated 2026-06-19 · CVE-2026-49216

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions symfony/ux-autocomplete versions prior to 2.x symfony/ux-autocomplete versions prior to 3.x

Description The Stimulus controller in the software renders AJAX response items into a dropdown by interpolating the text field directly into HTML template literals within the createAutocompleteWithRemoteData() function. Because the value is parsed as HTML instead of text, any markup in the AJAX response is executed by the browser. This allows an attacker to craft strings using user-supplied content to trigger stored Cross-Site Scripting (XSS), which is a vulnerability where malicious scripts are permanently stored on the target server and executed in the browsers of other users.

Recommendations Update to the patched version for branch 2.x. Update to the patched version for branch 3.x.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-49216

GHSA-MWQM-4FW3-CJVR

Affected Products

Ux-Autocomplete

References · 6

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/ux-autocomplete/CVE-2026-49216.yaml · Exploit
• https://osv.dev/vulnerability/GHSA-mwqm-4fw3-cjvr · Vendor Advisory
• https://github.com/symfony/ux/commit/842ae54bc74de389299f975f01aafae272cb0019 · Note
• https://github.com/symfony/ux · Note
• https://github.com/symfony/ux/security/advisories/GHSA-mwqm-4fw3-cjvr · Note
• https://twitter.com/dailycve/status/2068097213893410912 · Twitter Post