CVE-2026-49215
Description
Symfony UX is a JavaScript ecosystem for Symfony. From 2.22.0 until 2.36.0 and 3.1.0, Symfony\UX\LiveComponent\EventListener\LiveComponentSubscriber::isLiveComponentRequest() gates #[LiveAction] invocations on Accept: application/vnd.live-component+html, but the Accept header is CORS-safelisted and cross-origin fetch() can set it without preflight, allowing forged cross-origin #[LiveAction] requests against a victim session when applications use SameSite=None, credentials: 'include', a permissive cookie policy, or a same-origin pivot. This issue is fixed in versions 2.36.0 and 3.1.0.
How to fix
- symfony ux2.36.0 or later
- symfony/ux-live-component2.36.0, 3.1.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| symfony ux | 2.22.0 ≤ v < 2.36.0, 3.0.0 | 2.36.0 |
| symfony/ux-live-componentPackagist | 2.22.0 ≤ v < 2.36.0, 3.0.0 ≤ v < 3.1.0 | 2.36.0, 3.1.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.