ux vulnerabilities

3 known vulnerabilities in ux from Symfony. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  ux: Insufficient Verification of Data Authenticity

  CVE-2026-49212Jul 17, 2026Symfony

  Symfony UX is a JavaScript ecosystem for Symfony. From 2.8.0 until 2.36.0 and 3.1.0, the HMAC computed by Symfony\UX\LiveComponent\LiveComponentHydrator covered only sorted prop key/value pairs and did not include the component name, the slot identifier (props

• 7.5 High severity

  ux: Exposure of Sensitive Information to an Unauthorized Actor

  CVE-2026-49211Jul 17, 2026Symfony

  Symfony UX is a JavaScript ecosystem for Symfony. From 2.2.0 until 2.36.0 and 3.1.0, Symfony\UX\Autocomplete\Doctrine\EntitySearchUtil::addSearchClause() builds the LIKE expression used by the autocomplete endpoint by wrapping the client-supplied query in %...

• 7.8 High severity

  ux: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-55878Jul 8, 2026Symfony

  Symfony UX is a JavaScript ecosystem for Symfony. From 2.32.0 before 2.36.1 and from 3.0.0 before 3.2.0, the ux:install console command installs files from a recipe kit by copying paths listed in a copy-files map, and because Path::isRelative() accepts paths l