{"id":"CVE-2026-31823","aliases":["GHSA-mx4q-xxc9-pf5q"],"url":"https://o3.security/vulnerability/CVE-2026-31823","summary":"Sylius has Authenticated Stored XSS","details":"### Impact\n\nAn authenticated stored cross-site scripting (XSS) vulnerability exists in multiple places across the shop frontend and admin panel due to unsanitized entity names being rendered as raw HTML.\n\n**Shop breadcrumbs** (`shared/breadcrumbs.html.twig`): The `breadcrumbs` macro uses the Twig `|raw` filter on label values. Since taxon names, product names, and ancestor names flow directly into these labels, a malicious taxon name like `` is rendered and executed as JavaScript on the storefront.\n\n**Admin product taxon picker** (`ProductTaxonTreeController.js`): The `rowRenderer` method interpolates `${name}` directly into a template literal building HTML, allowing script injection through taxon names in the admin panel.\n\n**Admin autocomplete fields** (Tom Select): Dropdown items and options render entity names as raw HTML without escaping, allowing XSS through any autocomplete field displaying entity names.\n\nAn **authenticated administrator** can inject arbitrary HTML or JavaScript via entity names (e.g. taxon name) that is persistently rendered for all users.\n\n### Patches\n\nThe issue is fixed in versions: 2.0.16, 2.1.12, 2.2.3 and above.\n\n### Workarounds\n\nOverride vulnerable templates and JavaScript controllers at the project level.\n\n---\n\n#### Step 1 — Override shop breadcrumbs template\n\n`templates/bundles/SyliusShopBundle/shared/breadcrumbs.html.twig`:\n\n```twig\n{% macro breadcrumbs(items) %}\n
    \n {% for item in items %}\n
  1. \n {% if item.path is defined %}\n {{ item.label }}\n {% else %}\n {{ item.label }}\n {% endif %}\n
    2. \n {% endfor %}\n
\n{% endmacro %}\n```\n\n#### Step 2 — Override order breadcrumbs template\n\n`templates/bundles/SyliusShopBundle/account/order/show/content/breadcrumbs.html.twig`:\n\n```twig\n{% from '@SyliusShop/shared/breadcrumbs.html.twig' import breadcrumbs as breadcrumbs %}\n\n{% set order = hookable_metadata.context.order %}\n\n
\n {{ breadcrumbs([\n { label: 'sylius.ui.home'|trans, path: path('sylius_shop_homepage')},\n { label: 'sylius.ui.my_account'|trans, path: path('sylius_shop_account_dashboard')},\n { label: 'sylius.ui.order_history'|trans, path: path('sylius_shop_account_order_index')},\n { label: '#'~order.number, active: true, test_attribute: 'order-number' }\n ]) }}\n
\n```\n\n#### Step 3 — Override ProductTaxonTreeController.js\n\nDisable the vendor controller in `assets/admin/controllers.json`:\n\n```diff\n \"product-taxon-tree\": {\n- \"enabled\": true,\n+ \"enabled\": false,\n \"fetch\": \"lazy\"\n },\n```\n\nCreate `assets/admin/controllers/product_taxon_tree_controller.js` — copy the original from `vendor/sylius/sylius/src/Sylius/Bundle/AdminBundle/Resources/assets/controllers/ProductTaxonTreeController.js` and apply the following change:\n\n```diff\n+ const escapeHtml = (str) => {\n+ const div = document.createElement('div');\n+ div.textContent = str;\n+ return div.innerHTML;\n+ };\n\n // in rowRenderer:\n- ${name}\n+ ${escapeHtml(name)}\n```\n\nRegister the patched controller in `assets/admin/bootstrap.js`:\n\n```js\nimport ProductTaxonTreeController from './controllers/product_taxon_tree_controller';\napp.register('sylius--admin-bundle--product-taxon-tree', ProductTaxonTreeController);\n```\n\n#### Step 4 — Add autocomplete XSS protection\n\n`assets/admin/scripts/autocomplete-xss-protection.js`:\n\n```js\nconst escapeHtml = (str) => {\n if (typeof str !== 'string') return str;\n const div = document.createElement('div');\n div.textContent = str;\n return div.innerHTML;\n};\n\ndocument.addEventListener('autocomplete:pre-connect', (event) => {\n const options = event.detail.options;\n if (!options.render) return;\n\n const labelField = options.labelField || 'text';\n const wrapRenderer = (renderer) => {\n if (!renderer) return renderer;\n return (data, escape) => {\n const escaped = { ...data };\n if (escaped[labelField]) {\n escaped[labelField] = escapeHtml(escaped[labelField]);\n }\n return renderer(escaped, escape);\n };\n };\n\n if (options.render.item) options.render.item = wrapRenderer(options.render.item);\n if (options.render.option) options.render.option = wrapRenderer(options.render.option);\n});\n```\n\nImport in `assets/admin/entrypoint.js` **before** bootstrap:\n\n```diff\n+ import './scripts/autocomplete-xss-protection';\n import './bootstrap.js';\n```\n\n#### Step 5 — Rebuild assets\n\n```bash\nyarn encore dev # or: yarn encore production\n```\n\n### Reporters\n\nWe would like to extend our gratitude to the following individuals for their detailed reporting and responsible disclosure of this vulnerability:\n- Djibril Mounkoro (@whiteov3rflow)\n- Bartłomiej Nowiński (@bnBart)\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n- Open an issue in [Sylius issues](https://github.com/Sylius/Sylius/issues?q=sort%3Aupdated-desc+is%3Aissue+is%3Aopen)\n- Email us at [security@sylius.com](mailto:security@sylius.com)","published":"2026-03-10T21:29:13.828Z","modified":"2026-08-12T03:51:38.828267578Z","cvss":{"score":4.8,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"},"epss":{"score":0.00142,"percentile":0.04033,"asOf":"2026-08-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"sylius/sylius","fixedVersion":"2.0.16"},{"ecosystem":"Packagist","name":"sylius/sylius","fixedVersion":"2.1.12"},{"ecosystem":"Packagist","name":"sylius/sylius","fixedVersion":"2.2.3"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31823.json"},{"type":"ADVISORY","url":"https://github.com/Sylius/Sylius/security/advisories/GHSA-mx4q-xxc9-pf5q"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31823"},{"type":"PACKAGE","url":"https://github.com/Sylius/Sylius"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:38.828267578Z"}}