CVE-2026-49210

Name of the Vulnerable Software and Affected Versions Symfony UX versions 2.8.0 through 2.35.0 Symfony UX versions 3.0.0 through 3.0.x

Description In the SymfonyUXLiveComponentUtilChildComponentPartialRenderer::createHtml() function, the $childTag argument is interpolated directly into the HTML output as a tag name without escaping or validation. This value is derived from client-controlled JSON via the children[id].tag variable, which is processed by LiveComponentSubscriber and InterceptChildComponentRenderSubscriber. An attacker can inject arbitrary HTML, including <script> tags, during any re-render of a Live Component that contains at least one child component. By default, the Live Component endpoint requires an Accept: application/vnd.live-component+html header, which typically prevents cross-origin requests due to CORS preflight requirements. However, the issue is exploitable if CORS policies are relaxed to allow this header from untrusted origins or if the attacker has already achieved a same-origin XSS.

Recommendations Update Symfony UX to version 2.36.0. Update Symfony UX to version 3.1.0.