Executive brief
Symfony UX Autocomplete is a tool used by web developers to create smart dropdown menus that suggest results as a user types. A security flaw allows malicious data stored in the database to be executed as code in the web browser of any user who interacts with these dropdowns. This could lead to unauthorized actions being performed on behalf of users or the theft of sensitive session information.
Technical details
A stored Cross-Site Scripting (XSS) vulnerability exists in the Stimulus controller of symfony/ux-autocomplete. The root cause is located in the _createAutocompleteWithRemoteData() function, which interpolates the 'text' field from AJAX responses directly into HTML template literals (e.g., <div>${item[labelField]}</div>) instead of treating it as plain text. An attacker can supply malicious markup via user-controllable fields that are later served by the autocomplete AJAX endpoint. When a victim interacts with the autocomplete widget, the payload executes in their browser. The issue is fixed in versions 2.36.0 and 3.1.0 by implementing default HTML escaping using TomSelect's escape helper.
Affected products
- symfony ux-autocomplete >= 2.2.0, < 2.36.0
- symfony ux-autocomplete >= 3.0.0, < 3.1.0
Timeline
- 2026-05-24: patched: Fix committed to repository
- 2026-05-29: advisory: Security releases v2.36.0 and v3.1.0 published
- 2026-07-17: disclosed: CVE-2026-49216 published to NVD