CVE-2026-49212 Symfony UX: LiveComponentHydrator HMAC checksum lacks component and slot binding

What is CVE-2026-49212?

CVE-2026-49212 is a medium-severity vulnerability in symfony ux, published on 17 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Symfony UX is a JavaScript ecosystem for Symfony. From 2.8.0 until 2.36.0 and 3.1.0, the HMAC computed by Symfony\UX\LiveComponent\LiveComponentHydrator covered only sorted prop key/value pairs and did not include the component name, the slot identifier (props vs propsFromParent), or request context, allowing a signed blob minted for one component or slot to be replayed in another and set a read-only prop on a target component. This issue is fixed in versions 2.36.0 and 3.1.0.

Weakness: CWE-345

Which versions are affected by CVE-2026-49212?

4 open source packages ship an affected version, including symfony/ux-live-component. It affects 1 product.

Products include Symfony Ux.

How do I fix CVE-2026-49212?

Upgrade symfony/ux-live-component to a fixed version for your release line: 2.36.0 or 3.1.0.

Is CVE-2026-49212 being exploited?

There is no known exploitation of CVE-2026-49212 in the wild and no public exploit code.

Other vulnerabilities in symfony ux

• CVE-2026-49208 Symfony UX: Format-less date LiveProps parsed with the permissive DateTime constructor Medium 6.9
• CVE-2026-49211 Symfony UX: Information exposure via unescaped LIKE wildcards in EntitySearchUtil Medium 6.9
• CVE-2026-55877 Symfony UX: XSS in symfony/ux-icons via unsanitized SVG content in local files and Iconify on-demand responses Medium 6.1
• CVE-2026-49209 Symfony UX: Denial of service in symfony/ux-live-component via unbounded batch action requests Medium 5.3
• CVE-2026-49216 Symfony UX: XSS in symfony/ux-autocomplete via unescaped AJAX response data Medium 5.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-34w5-c283-j9fg.