CVE-2026-49216

Name of the Vulnerable Software and Affected Versions symfony/ux-autocomplete versions 2.2.0 through 2.35.0

Description The Stimulus controller in symfony/ux-autocomplete renders AJAX response items within the createAutocompleteWithRemoteData() function by interpolating the text field directly into HTML template literals. Because the value is parsed as HTML instead of text, any markup contained in the AJAX response is executed by the browser. This allows an attacker to craft strings that trigger stored Cross-Site Scripting (XSS) in the browser of users who open an autocomplete widget backed by user-supplied data.

Recommendations Update symfony/ux-autocomplete to version 2.36.0 or 3.1.0. As a temporary mitigation, restrict the use of the createAutocompleteWithRemoteData() function or ensure that data returned by the AJAX response is strictly sanitized before being processed by the autocomplete widget.