{"id":"CVE-2026-49216","aliases":["GHSA-mwqm-4fw3-cjvr"],"url":"https://o3.security/vulnerability/CVE-2026-49216","summary":"Symfony UX: XSS in symfony/ux-autocomplete via unescaped AJAX response data","details":"### Description\n\nThe Stimulus controller shipped with `symfony/ux-autocomplete` renders AJAX response items into the dropdown by interpolating the `text` field directly into HTML template literals (`<div>${item[labelField]}</div>`) inside `_createAutocompleteWithRemoteData()`. The value is parsed as HTML rather than text, so any markup contained in the AJAX response is executed by the browser.\n\nWhen the dropdown values are derived from user-supplied content, an attacker can craft a string that triggers stored XSS in the browser of any other user who later opens a page containing an autocomplete widget backed by the same data.\n\n### Resolution\n\nThe `option` and `item` renderers used in `_createAutocompleteWithRemoteData()` now use TomSelect's `escape` helper to HTML-escape the value by default. Endpoints that legitimately return HTML (for example, to highlight the search term) can opt back in to the previous behavior by setting `options_as_html: true`. The `AutocompleteChoiceTypeExtension` normalizer that previously forced `options_as_html=false` when `autocomplete_url` was set has been dropped so the opt-in is reachable from the form layer.\n\nThe patch for this issue is available [here](https://github.com/symfony/ux/commit/842ae54bc74de389299f975f01aafae272cb0019) for branch 2.x (and forward-ported to 3.x).\n\n### Credits\n\nSymfony would like to thank Alex Ashkov for reporting the issue and Hugo Alliaume for providing the fix.","published":"2026-07-17T16:15:34.990Z","modified":"2026-10-28T02:30:46.999892388Z","cvss":null,"epss":{"score":0.00312,"percentile":0.24084,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"symfony/ux-autocomplete","fixedVersion":"2.36.0"},{"ecosystem":"Packagist","name":"symfony/ux-autocomplete","fixedVersion":"3.1.0"}],"fix":{"url":"https://github.com/symfony/ux/commit/842ae54bc74de389299f975f01aafae272cb0019","label":"symfony/ux@842ae54"},"references":[{"type":"WEB","url":"https://github.com/symfony/ux/releases/tag/v2.36.0"},{"type":"WEB","url":"https://github.com/symfony/ux/releases/tag/v3.1.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49216.json"},{"type":"ADVISORY","url":"https://github.com/symfony/ux/security/advisories/GHSA-mwqm-4fw3-cjvr"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49216"},{"type":"FIX","url":"https://github.com/symfony/ux/commit/842ae54bc74de389299f975f01aafae272cb0019"},{"type":"WEB","url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/ux-autocomplete/CVE-2026-49216.yaml"},{"type":"PACKAGE","url":"https://github.com/symfony/ux"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:30:46.999892388Z"}}