Back to Database
Status published
Medium
CVE-2023-41336
Prevent injection of invalid entity ids for "autocomplete" fields in symfony ux-autocomplete
Vulnerability Description
ux-autocomplete is a JavaScript Autocomplete functionality for Symfony. Under certain circumstances, an attacker could successfully submit an entity id for an `EntityType` that is *not* part of the valid choices. The problem has been fixed in `symfony/ux-autocomplete` version 2.11.2.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-41336
Credits & Attribution
No credits recorded in the NVD database.
References
- https://github.com/symfony/ux-autocomplete/security/advisories/GHSA-4cpv-669c-r79x
- https://github.com/symfony/ux-autocomplete/commit/fabcb2eee14b9e84a45b276711853a560b5d770c
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/ux-autocomplete/CVE-2023-41336.yaml
- https://symfony.com/bundles/ux-autocomplete/current/index.html#usage-in-a-form-with-ajax
More from symfony
View All →CVE-2025-64500
Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass
High
7.3
CVE-2025-47946
symfony/ux-live-component and symfony/ux-twig-component vulnerable to unsanitized HTML attribute injection via ComponentAttributes
Medium
6.1
CVE-2024-51996
Symphony has an Authentication Bypass via RememberMe
High
7.5
CVE-2024-51736
Command execution hijack on Windows with Process class in symfony/process
Unknown
0
CVE-2024-50345
Open redirect via browser-sanitized URLs in symfony/http-foundation
Low
3.1
Affected Vendor
symfony
View all reports →Affected Software
ux-autocomplete
Vulnerable Versions:
< 2.11.2
Timeline
Official Publish:
September 11th, 2023
Last Modified:
September 26th, 2024
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N