Executive brief
Symfony UX LiveComponent, a tool used to build interactive web interfaces, contains a security flaw that could allow attackers to inject malicious scripts into a website. By sending specially crafted data to a server, an attacker could execute unauthorized code in a user's browser, potentially leading to data theft or unauthorized actions. This risk is highest for applications with specific cross-origin (CORS) configurations or those already compromised by other vulnerabilities.
Technical details
A Cross-Site Scripting (XSS) vulnerability exists in Symfony UX LiveComponent's ChildComponentPartialRenderer::createHtml() method. The component interpolates the client-provided 'children[id].tag' value directly into the HTML output as a tag name without proper escaping or validation. An attacker can exploit this by sending a malicious JSON payload to the Live Component endpoint, injecting arbitrary HTML or <script> tags. While default configurations require a specific 'Accept' header that mitigates cross-origin attacks, the vulnerability is exploitable if CORS policies are overly permissive or if the attacker has achieved a same-origin pivot. The issue is resolved in versions 2.36.0 and 3.1.0 by implementing a strict regex validation for HTML tag names.
Affected products
- Symfony ux-live-component >= 2.8.0, < 2.36.0; >= 3.0.0, < 3.1.0
Timeline
- 2026-05-29: patched: Fixed in versions 2.36.0 and 3.1.0
- 2026-05-29: advisory: GitHub Security Advisory published
- 2026-07-17: disclosed: CVE published to NVD