https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-21T08:48:29.252006+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-188884 EUVD-2026-188884 2026-10-21T08:48:29.255102+00:00 EUVD-2026-188884 https://cve.radiocsirt.org/vuln/fkie_cve-2023-41336 fkie_cve-2023-41336 2026-10-21T08:48:29.255146+00:00

ux-autocomplete is a JavaScript Autocomplete functionality for Symfony. Under certain circumstances, an attacker could successfully submit an entity id for an `EntityType` that is *not* part of the valid choices. The problem has been fixed in `symfony/ux-autocomplete` version 2.11.2.

 https://cve.radiocsirt.org/vuln/ghsa-4cpv-669c-r79x GHSA-4cpv-669c-r79x — Prevent injection of invalid entity ids for "autocomplete" fields 2026-10-21T08:48:29.255201+00:00

Affected: Packagist: symfony/ux-autocomplete

### Impact Under certain circumstances, an attacker could successfully submit an entity id for an `EntityType` that is *not* part of the valid choices.

Affected applications are any that use:

* A custom `query_builder` option to limit the valid results; AND * An `EntityType` with `'autocomplete' => true` or a custom [AsEntityAutocompleteField](https://symfony.com/bundles/ux-autocomplete/current/index.html#usage-in-a-form-with-ajax).

Under this circumstance, if an id is submitted, it is accepted even if the matching record would not be returned by the custom query built with `query_builder`.

### Patches

The problem has been fixed in `symfony/ux-autocomplete` version 2.11.2.

### Workarounds Upgrade to version 2.11.2 or greater of `symfony/ux-autocomplete` or perform extra validation after submit to verify the selected option is valid.

 https://cve.radiocsirt.org/vuln/gsd-2023-41336 gsd-2023-41336 2026-10-21T08:48:29.255304+00:00 gsd-2023-41336