CVE-2026-49210: Symfony UX LiveComponent XSS Vulnerability

CVE-2026-49210 Overview

CVE-2026-49210 is a cross-site scripting (XSS) vulnerability in Symfony UX LiveComponent. The flaw resides in Symfony\UX\LiveComponent\Util\ChildComponentPartialRenderer::createHtml(), which interpolates the client-controlled children[id].tag value directly into HTML output without escaping or validation. An attacker can supply an arbitrary tag name, including <script> payloads, that gets rendered on any Live Component re-render containing at least one child component. The vulnerability affects Symfony UX versions from 2.8.0 through 2.36.0 and 3.1.0, and is tracked under [CWE-79]. It was published to the National Vulnerability Database (NVD) on 2026-07-17.

Critical Impact
Attackers can inject arbitrary HTML and JavaScript into rendered Live Components, enabling client-side code execution in the victim's browser session.

Affected Products

Symfony UX versions 2.8.0 through 2.35.x
Symfony UX version 3.0.0 through 3.0.x
Symfony UX LiveComponent package (symfony:ux)

Discovery Timeline

2026-07-17 - CVE-2026-49210 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-49210

Vulnerability Analysis

The defect lives in the ChildComponentPartialRenderer utility class of Symfony UX LiveComponent. When Symfony re-renders a Live Component that contains child components, the framework builds HTML markup by interpolating the child's tag attribute directly into the output string. Because createHtml() treats the tag value as trusted, no HTML escaping or allow-list validation is applied.

The tag value originates from client-controlled input processed through LiveComponentSubscriber and InterceptChildComponentRenderSubscriber. An attacker who can influence the child component payload can therefore substitute an arbitrary string, including tag names carrying inline event handlers or <script> content, into the rendered markup. The browser then parses and executes that markup on any subsequent re-render.

Root Cause

The root cause is missing output encoding on a client-influenced field used as an HTML tag identifier. The renderer assumes children[id].tag conforms to a valid HTML element name, but never enforces that assumption through validation or escaping before concatenation.

Attack Vector

Exploitation requires network access to the LiveComponent endpoint and some user interaction to trigger a re-render. An attacker crafts a request that manipulates the children[id].tag field with a malicious payload. When the LiveComponent re-renders and returns HTML to the victim's browser, the injected markup executes in the application's origin.

php

 namespace Symfony\UX\LiveComponent\Util;
 
 use Psr\Container\ContainerInterface;
+use Symfony\Component\HttpKernel\Exception\BadRequestHttpException;
 use Symfony\Contracts\Service\ServiceSubscriberInterface;
 use Symfony\UX\LiveComponent\LiveComponentHydrator;
 use Symfony\UX\LiveComponent\Metadata\LiveComponentMetadataFactory;

Source: Symfony UX security patch commit. The patch introduces BadRequestHttpException handling to reject malicious child component tags before rendering.

Detection Methods for CVE-2026-49210

Indicators of Compromise

LiveComponent HTTP requests containing unusual characters (<, >, ", ', or /) inside the children[id].tag field of the JSON payload.
Server responses returning <script> tags or inline event handlers such as onerror= inside re-rendered Live Component fragments.
Browser Content Security Policy (CSP) violation reports referencing inline script execution originating from Symfony UX endpoints.

Detection Strategies

Inspect application logs for POST requests to LiveComponent update routes that carry non-alphanumeric characters in tag fields.
Deploy web application firewall (WAF) rules that flag or block requests where LiveComponent child tag values do not match a strict [a-zA-Z][a-zA-Z0-9-]* pattern.
Correlate LiveComponent request payloads with subsequent HTML responses to identify tag-name reflection anomalies.

Monitoring Recommendations

Enable structured logging on the Symfony HTTP kernel and capture full request bodies for LiveComponent endpoints during triage.
Monitor CSP report-uri endpoints for spikes in inline-script violations following Symfony UX traffic.
Track versions of the symfony/ux-live-component package across environments using software composition analysis.

How to Mitigate CVE-2026-49210

Immediate Actions Required

Upgrade symfony/ux-live-component to version 2.36.0 for the 2.x branch or 3.1.0 for the 3.x branch.
Audit application logs for prior LiveComponent requests containing suspicious tag values.
Rotate session cookies and revoke authenticated sessions if evidence of exploitation exists.

Patch Information

The vulnerability is fixed in Symfony UX v2.36.0 and v3.1.0. The patch commit fbc5e9a rejects malicious child component tags by throwing BadRequestHttpException when a supplied tag fails validation. Full details are available in GitHub Security Advisory GHSA-38x5-rcv4-xf7x.

Workarounds

Enforce a strict Content Security Policy that disallows inline scripts (script-src 'self') to reduce impact of injected markup.
Add a reverse-proxy or WAF rule to reject LiveComponent request bodies whose children[*].tag fields contain characters outside [a-zA-Z0-9-].
Restrict access to LiveComponent endpoints behind authentication and rate-limiting until the upgrade is applied.

bash

# Upgrade Symfony UX LiveComponent to a patched release
composer require symfony/ux-live-component:^2.36.0
# or, for the 3.x branch
composer require symfony/ux-live-component:^3.1.0

# Verify installed version
composer show symfony/ux-live-component | grep versions