https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 02:40:14 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-338531 EUVD-2026-338531 https://cve.radiocsirt.org/vuln/euvd-2026-338531 https://cve.radiocsirt.org/vuln/fkie_cve-2026-49210 <p>Symfony UX is a JavaScript ecosystem for Symfony. From 2.8.0 until 2.36.0 and 3.1.0, Symfony\UX\LiveComponent\Util\ChildComponentPartialRenderer::createHtml() interpolates the client-controlled children[id].tag value from LiveComponentSubscriber and InterceptChildComponentRenderSubscriber directly into HTML as a tag name without escaping or validation, allowing arbitrary HTML, including &lt;script&gt; tags, on any Live Component re-render that contains at least one child component. This issue is fixed in versions 2.36.0 and 3.1.0.</p> <p>Symfony UX is a JavaScript ecosystem for Symfony. From 2.8.0 until 2.36.0 and 3.1.0, Symfony\UX\LiveComponent\Util\ChildComponentPartialRenderer::createHtml() interpolates the client-controlled children[id].tag value from LiveComponentSubscriber and InterceptChildComponentRenderSubscriber directly into HTML as a tag name without escaping or validation, allowing arbitrary HTML, including &lt;script&gt; tags, on any Live Component re-render that contains at least one child component. This issue is fixed in versions 2.36.0 and 3.1.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-49210 https://cve.radiocsirt.org/vuln/ghsa-38x5-rcv4-xf7x <p><strong>Affected:</strong> Packagist: symfony/ux-live-component</p> <p>### Description</p> <p>`Symfony\UX\LiveComponent\Util\ChildComponentPartialRenderer::createHtml()` interpolates the `$childTag` argument directly into the HTML output as a tag name, without escaping or validation. The value originates from client-controlled JSON (`children[id].tag`) parsed by `LiveComponentSubscriber` and propagated through `InterceptChildComponentRenderSubscriber`, so an attacker who can reach the Live Component endpoint can inject arbitrary HTML, including `&lt;script&gt;` tags, on any re-render of a Live Component that contains at least one child component.</p> <p>In the default configuration, the Live Component endpoint is gated by an `Accept: application/vnd.live-component+html` request-header check that cannot be set cross-origin without a CORS preflight, so the issue is primarily a defense-in-depth gap. It becomes directly exploitable on applications that have relaxed CORS to allow this header from untrusted origins, or that have been pivoted from another same-origin XSS.</p> <p>### Resolution</p> <p>`ChildComponentPartialRenderer` now validates `$childTag` against a strict HTML tag-name regex before interpolating it, and rejects any value that doesn&#39;t match. Anything that wouldn&#39;t be a valid HTML tag is dropped before reaching the response.</p> <p>The patch for this issue is available [here](https://github.com/symfony/ux/commit/fbc5e9a1bda7e4556be21bb1d970f382760ed9a9) for branch 2.x (and forward-ported to 3.x).</p> <p>### Credits</p> <p>Symfony would like to thank Pascal Cescon for reporting the…</p> <p><strong>Affected:</strong> Packagist: symfony/ux-live-component</p> <p>### Description</p> <p>`Symfony\UX\LiveComponent\Util\ChildComponentPartialRenderer::createHtml()` interpolates the `$childTag` argument directly into the HTML output as a tag name, without escaping or validation. The value originates from client-controlled JSON (`children[id].tag`) parsed by `LiveComponentSubscriber` and propagated through `InterceptChildComponentRenderSubscriber`, so an attacker who can reach the Live Component endpoint can inject arbitrary HTML, including `&lt;script&gt;` tags, on any re-render of a Live Component that contains at least one child component.</p> <p>In the default configuration, the Live Component endpoint is gated by an `Accept: application/vnd.live-component+html` request-header check that cannot be set cross-origin without a CORS preflight, so the issue is primarily a defense-in-depth gap. It becomes directly exploitable on applications that have relaxed CORS to allow this header from untrusted origins, or that have been pivoted from another same-origin XSS.</p> <p>### Resolution</p> <p>`ChildComponentPartialRenderer` now validates `$childTag` against a strict HTML tag-name regex before interpolating it, and rejects any value that doesn&#39;t match. Anything that wouldn&#39;t be a valid HTML tag is dropped before reaching the response.</p> <p>The patch for this issue is available [here](https://github.com/symfony/ux/commit/fbc5e9a1bda7e4556be21bb1d970f382760ed9a9) for branch 2.x (and forward-ported to 3.x).</p> <p>### Credits</p> <p>Symfony would like to thank Pascal Cescon for reporting the…</p> https://cve.radiocsirt.org/vuln/ghsa-38x5-rcv4-xf7x