EUVD-2026-45210
GHSA-38x5-rcv4-xf7x
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AV:N because the endpoint is network-accessible; AC:H because exploitation requires non-default CORS or a same-origin pivot; UI:R because a victim must trigger the component re-render; S:C and C:L/I:L reflect standard reflected-XSS scope change with session/data impact.
Primary rating from Vendor (https://github.com/symfony/ux).
CVSS VectorVendor: https://github.com/symfony/ux
Lifecycle Timeline
3DescriptionCVE.org
Description
Symfony\UX\LiveComponent\Util\ChildComponentPartialRenderer::createHtml() interpolates the $childTag argument directly into the HTML output as a tag name, without escaping or validation. The value originates from client-controlled JSON (children[id].tag) parsed by LiveComponentSubscriber and propagated through InterceptChildComponentRenderSubscriber, so an attacker who can reach the Live Component endpoint can inject arbitrary HTML, including <script> tags, on any re-render of a Live Component that contains at least one child component.
In the default configuration, the Live Component endpoint is gated by an Accept: application/vnd.live-component+html request-header check that cannot be set cross-origin without a CORS preflight, so the issue is primarily a defense-in-depth gap. It becomes directly exploitable on applications that have relaxed CORS to allow this header from untrusted origins, or that have been pivoted from another same-origin XSS.
Resolution
ChildComponentPartialRenderer now validates $childTag against a strict HTML tag-name regex before interpolating it, and rejects any value that doesn't match. Anything that wouldn't be a valid HTML tag is dropped before reaching the response.
The patch for this issue is available here for branch 2.x (and forward-ported to 3.x).
Credits
Symfony would like to thank Pascal Cescon for reporting the issue and Hugo Alliaume for providing the fix.
AnalysisAI
Cross-site scripting in symfony/ux-live-component allows network-accessible attackers to inject arbitrary HTML - including script tags - into re-rendered Live Component responses by supplying a malicious tag name via client-controlled JSON. Affected versions span composer/symfony/ux-live-component >= 2.8.0 < 2.36.0 and >= 3.0.0 < 3.1.0. Direct exploitation is constrained to applications with permissive CORS or same-origin pivot contexts; under default configuration the required Accept header provides partial protection that makes this a defense-in-depth gap rather than an immediately weaponizable internet-wide threat. No public exploit and no CISA KEV listing are confirmed at time of analysis.
Technical ContextAI
Symfony UX LiveComponent is a PHP/Twig framework extension that enables reactive, AJAX-driven UI components (composer package symfony/ux-live-component). During a partial re-render, the server processes a JSON payload from the client describing child component state - including a 'tag' field (children[id].tag) representing the HTML element name to wrap the child component. This value flowed from LiveComponentSubscriber through InterceptChildComponentRenderSubscriber into ChildComponentPartialRenderer::createHtml(), where it was interpolated directly into the HTML output as the tag name without sanitization or validation. CWE-79 (Improper Neutralization of Input During Web Page Generation) is the root cause: user-supplied data was treated as trusted markup rather than content. The patch adds a strict allow-list regex (/\A[a-zA-Z][a-zA-Z0-9-]*+\z/) and raises a BadRequestHttpException on any non-conforming value, closing the injection point at the class boundary.
RemediationAI
The primary fix is to upgrade symfony/ux-live-component to 2.36.0 (for 2.x installations) or 3.1.0 (for 3.x installations). The upstream patch is available at https://github.com/symfony/ux/commit/fbc5e9a1bda7e4556be21bb1d970f382760ed9a9 and has been forward-ported to both branches. If an immediate upgrade is not feasible, the most impactful compensating control is to audit and restrict your application's CORS policy: ensure the Accept: application/vnd.live-component+html header cannot be sent from untrusted origins without a preflight that your server will reject. This is the single configuration that elevates the vulnerability from a defense-in-depth gap to a directly exploitable issue. Additionally, enforcing Content-Security-Policy headers to block inline script execution will reduce the potential impact of any successful XSS injection. Note that CSP is a mitigating layer, not a fix - it does not remove the injection point. Full remediation requires the patch.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today