CVE-2026-49208 Symfony UX: Format-less date LiveProps parsed with the permissive DateTime constructor

What is CVE-2026-49208?

CVE-2026-49208 is a medium-severity vulnerability in symfony ux, published on 17 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Symfony UX is a JavaScript ecosystem for Symfony. From 2.8.0 until 2.36.0 and 3.1.0, when a #[LiveProp] is typed as DateTimeInterface and no explicit format is configured, Symfony\UX\LiveComponent\LiveComponentHydrator::hydrateObjectValue() falls back to new $className($value), allowing client-supplied relative strings such as now, tomorrow, or +10 years to move a writable, format-less date prop past time-based business logic checks. This issue is fixed in versions 2.36.0 and 3.1.0.

Weakness: CWE-20

Which versions are affected by CVE-2026-49208?

4 open source packages ship an affected version, including symfony/ux-live-component. It affects 1 product.

Products include Symfony Ux.

How do I fix CVE-2026-49208?

Upgrade symfony/ux-live-component to a fixed version for your release line: 2.36.0 or 3.1.0.

Is CVE-2026-49208 being exploited?

There is no known exploitation of CVE-2026-49208 in the wild and no public exploit code.

Other vulnerabilities in symfony ux

• CVE-2026-49211 Symfony UX: Information exposure via unescaped LIKE wildcards in EntitySearchUtil Medium 6.9
• CVE-2026-49212 Symfony UX: LiveComponentHydrator HMAC checksum lacks component and slot binding Medium 6.9
• CVE-2026-55877 Symfony UX: XSS in symfony/ux-icons via unsanitized SVG content in local files and Iconify on-demand responses Medium 6.1
• CVE-2026-49209 Symfony UX: Denial of service in symfony/ux-live-component via unbounded batch action requests Medium 5.3
• CVE-2026-49216 Symfony UX: XSS in symfony/ux-autocomplete via unescaped AJAX response data Medium 5.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-89g7-22c8-3j23.