CVE-2026-49216 Symfony UX: XSS in symfony/ux-autocomplete via unescaped AJAX response data

Symfony UX is a JavaScript ecosystem for Symfony. From 2.2.0 until 2.36.0 and 3.1.0, the Stimulus controller in symfony/ux-autocomplete renders AJAX response items in createAutocompleteWithRemoteData by interpolating the text field into HTML template literals $itemlabelField rather than text,...

PT-2026-51055

Name of the Vulnerable Software and Affected Versions symfony/ux-autocomplete versions 2.2.0 through 2.35.0 Description The Stimulus controller in symfony/ux-autocomplete renders AJAX response items within the createAutocompleteWithRemoteData function by interpolating the text field directly into...