Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Symfony UX is a JavaScript ecosystem for Symfony. From 2.2.0 until 2.36.0 and 3.1.0, the Stimulus controller in symfony/ux-autocomplete renders AJAX response items in _createAutocompleteWithRemoteData() by interpolating the text field into HTML template literals (<div>${item[labelField]}</div>) rather than text, allowing attacker-controlled markup from user-supplied dropdown values to execute in the browser of any user who opens an autocomplete widget backed by the same data. This issue is fixed in versions 2.36.0 and 3.1.0.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
🟠 Symfony UX Autocomplete, Cross-Site Scripting (XSS), #CVE-2026-49216 (Moderate) -DC-Jun2026-510 https://dailycve.com/symfony-ux-autocomplete-cross-site-scripting-xss-cve-2026-49216-moderate-dc-jun2026-510/
Post summary
The text announces CVE‑2026‑49216 affecting Symfony UX Autocomplete, describing a moderate‑severity XSS vulnerability, without providing PoC, exploit details, or patch information.
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | symfony | ux | - | - | - |
| App | symfony | ux | 3.0.0 | - | - |