CVE-2026-31822

Sylius has a XSS vulnerability in checkout login form

State: Published
Severity: 5.3 Medium
Published: Mar 10, 2026
Updated: Mar 11, 2026
Reserved: Mar 9, 2026

Description

Sylius is an Open Source eCommerce Framework on Symfony. A cross-site scripting (XSS) vulnerability exists in the shop checkout login form handled by the ApiLoginController Stimulus controller. When a login attempt fails, AuthenticationFailureHandler returns a JSON response whose message field is rendered into the DOM using innerHTML, allowing any HTML or JavaScript in that value to be parsed and executed by the browser. The issue is fixed in versions: 2.0.16, 2.1.12, 2.2.3 and above.

Scores

CVSS	Score	Vector	Source
4.0	5.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N	GitHub_M

Weaknesses

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Products

Product	Versions
SyliusSylius	>= 2.2.0, < 2.2.3Affected >= 2.1.0, < 2.1.12Affected >= 2.0.0, < 2.0.16Affected

References

https://github.com/Sylius/Sylius/security/advisories/GHSA-vgh8-c6fp-7gcg

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.