CVE-2026-31823: Sylius eCommerce Framework XSS Vulnerability

CVE-2026-31823 Overview

CVE-2026-31823 is a stored Cross-Site Scripting (XSS) vulnerability affecting multiple components of the Sylius eCommerce Framework built on Symfony. The vulnerability exists due to unsanitized entity names being rendered as raw HTML across the shop frontend and admin panel. An authenticated administrator can inject arbitrary HTML or JavaScript via entity names (such as taxon names) that is persistently rendered for all users, potentially leading to session hijacking, credential theft, or unauthorized actions on behalf of victims.

Critical Impact

Authenticated administrators can inject persistent malicious scripts via entity names that execute in the browsers of all users viewing the affected pages, including other administrators and customers on the storefront.

Affected Products

• Sylius versions prior to 1.9.12
• Sylius versions 1.10.x prior to 1.10.16
• Sylius versions 1.11.x prior to 1.11.17
• Sylius versions 1.12.x prior to 1.12.23
• Sylius versions 1.13.x prior to 1.13.15
• Sylius versions 1.14.x prior to 1.14.18
• Sylius versions 2.0.x prior to 2.0.16
• Sylius versions 2.1.x prior to 2.1.12
• Sylius versions 2.2.x prior to 2.2.3

Discovery Timeline

• 2026-03-10 - CVE-2026-31823 published to NVD
• 2026-03-11 - Last updated in NVD database

Technical Details for CVE-2026-31823

Vulnerability Analysis

This stored XSS vulnerability (CWE-79) stems from improper output encoding across multiple components in the Sylius eCommerce platform. The vulnerability affects three distinct areas of the application, each with its own injection point but sharing the common root cause of rendering user-controlled entity names without proper HTML escaping.

The first affected component is the shop breadcrumbs template (shared/breadcrumbs.html.twig), where the breadcrumbs macro applies the Twig |raw filter to label values. Since taxon names, product names, and ancestor names flow directly into these labels, any malicious HTML or JavaScript embedded in these entity names is rendered and executed on the storefront.

The second affected component is the Admin product taxon picker (ProductTaxonTreeController.js), where the rowRenderer method interpolates the ${name} variable directly into a template literal that builds HTML content. This allows script injection through taxon names when administrators interact with the product categorization interface.

The third affected component involves Admin autocomplete fields using Tom Select, where dropdown items and options render entity names as raw HTML without proper escaping. This enables XSS through any autocomplete field that displays entity names throughout the admin panel.

Root Cause

The root cause of this vulnerability is the improper use of the Twig |raw filter and direct HTML string interpolation without escaping user-controlled entity name values. In Twig templates, the |raw filter explicitly disables the auto-escaping feature, allowing HTML and JavaScript to be rendered directly in the browser. Similarly, in the JavaScript components, entity names are concatenated or interpolated directly into HTML strings without encoding special characters, bypassing any client-side protection against script injection.

Attack Vector

The attack requires network access and authentication with administrative privileges. An attacker with administrator access can create or modify entities (such as taxons or products) with malicious names containing JavaScript payloads. These payloads are then stored in the database and rendered whenever any user—including other administrators or storefront customers—views pages that display the affected entity names.

A malicious taxon name such as <img src=x onerror=alert('XSS')> would be stored in the database and executed as JavaScript whenever the breadcrumbs, taxon picker, or autocomplete fields render that entity name. The scope change in the CVSS vector indicates that the vulnerability impacts users beyond the authenticated session of the attacker, affecting all visitors who view the compromised content.

Detection Methods for CVE-2026-31823

Indicators of Compromise

• Entity names (taxons, products, categories) containing HTML tags such as <script>, <img>, <svg>, or event handlers like onerror, onload, onclick
• Database entries with unexpected JavaScript code or HTML markup in name fields
• Unusual administrator activity creating or modifying entities with special characters or encoded payloads

Detection Strategies

• Implement Content Security Policy (CSP) headers with violation reporting to detect inline script execution attempts
• Monitor application logs for entity creation/modification events containing HTML special characters or script-related keywords
• Deploy Web Application Firewall (WAF) rules to detect and log XSS payloads in POST request bodies to entity management endpoints
• Conduct periodic database audits scanning entity name fields for HTML tags and JavaScript code patterns

Monitoring Recommendations

• Enable detailed audit logging for all entity CRUD operations in the Sylius admin panel
• Configure browser-based XSS detection alerts through CSP report-uri directives
• Monitor for unusual patterns in administrator account activity, particularly bulk entity modifications
• Implement real-time alerting for database records containing <script> tags or JavaScript event handlers in name fields

How to Mitigate CVE-2026-31823

Immediate Actions Required

• Upgrade Sylius to the patched version corresponding to your release branch immediately
• Audit existing entity names (taxons, products, categories) in the database for malicious HTML or JavaScript content
• Review administrator account access and privileges, revoking access for any compromised or suspicious accounts
• Implement a Web Application Firewall with XSS filtering rules as an additional defense layer

Patch Information

Sylius has released security patches addressing this vulnerability. Organizations should upgrade to one of the following fixed versions based on their current release branch:

• Version 1.9.12 or later for the 1.9.x branch
• Version 1.10.16 or later for the 1.10.x branch
• Version 1.11.17 or later for the 1.11.x branch
• Version 1.12.23 or later for the 1.12.x branch
• Version 1.13.15 or later for the 1.13.x branch
• Version 1.14.18 or later for the 1.14.x branch
• Version 2.0.16 or later for the 2.0.x branch
• Version 2.1.12 or later for the 2.1.x branch
• Version 2.2.3 or later for the 2.2.x branch

For complete details on the security fix, refer to the Sylius GitHub Security Advisory.

Workarounds

• If immediate patching is not possible, implement input validation on the server-side to strip or reject entity names containing HTML tags or JavaScript
• Manually modify affected Twig templates to replace |raw filter usage with proper escaping using |e('html') or removing the raw filter entirely
• Deploy a reverse proxy or WAF with strict XSS filtering rules to sanitize malicious payloads before they reach the application
• Restrict administrator privileges to limit which users can create or modify entity names in the system

# Update Sylius using Composer to the latest patched version
composer update sylius/sylius --with-all-dependencies

# Verify the installed version after update
composer show sylius/sylius | grep versions