CVE-2026-49210

Summary: CVE-2026-49210 affects Symfony UX LiveComponent’s ChildComponentPartialRenderer::createHtml(), where client-controlled children[id].tag is interpolated into HTML as a tag name without validation/escaping, enabling an attacker to inject arbitrary HTML (including [removed] tags) during a L...

CVE-2026-49210 Symfony UX: XSS in symfony/ux-live-component via attacker-controlled child component tag

Symfony UX is a JavaScript ecosystem for Symfony. From 2.8.0 until 2.36.0 and 3.1.0, Symfony\UX\LiveComponent\Util\ChildComponentPartialRenderer::createHtml interpolates the client-controlled childrenid.tag value from LiveComponentSubscriber and InterceptChildComponentRenderSubscriber directly in...

GHSA-38X5-RCV4-XF7X symfony/ux-live-component: XSS via attacker-controlled child component tag

Description Symfony\UX\LiveComponent\Util\ChildComponentPartialRenderer::createHtml interpolates the $childTag argument directly into the HTML output as a tag name, without escaping or validation. The value originates from client-controlled JSON childrenid.tag parsed by LiveComponentSubscriber an...

symfony/ux-live-component: XSS via attacker-controlled child component tag

Description Symfony\UX\LiveComponent\Util\ChildComponentPartialRenderer::createHtml interpolates the $childTag argument directly into the HTML output as a tag name, without escaping or validation. The value originates from client-controlled JSON childrenid.tag parsed by LiveComponentSubscriber an...

Cross-site Scripting (XSS)

Overview symfony/ux-live-component is a Live components for Symfony Affected versions of this package are vulnerable to Cross-site Scripting XSS via improper handling of child component tag names in ChildComponentPartialRenderer::createHtml. An attacker can inject arbitrary HTML, including...