{"id":"GHSA-mx4q-xxc9-pf5q","aliases":["CVE-2026-31823"],"title":"Sylius Vulnerable to Authenticated Stored XSS","titleSource":"OSV","descriptionSource":"OSV","declaredSeverity":"MODERATE","description":"### Impact\n\nAn authenticated stored cross-site scripting (XSS) vulnerability exists in multiple places across the shop frontend and admin panel due to unsanitized entity names being rendered as raw HTML.\n\n**Shop breadcrumbs** (`shared/breadcrumbs.html.twig`): The `breadcrumbs` macro uses the Twig `|raw` filter on label values. Since taxon names, product names, and ancestor names flow directly into these labels, a malicious taxon name like `<img src=x onerror=alert('XSS')>` is rendered and executed as JavaScript on the storefront.\n\n**Admin product taxon picker** (`ProductTaxonTreeController.js`): The `rowRenderer` method interpolates `${name}` directly into a template literal building HTML, allowing script injection through taxon names in the admin panel.\n\n**Admin autocomplete fields** (Tom Select): Dropdown items and options render entity names as raw HTML without escaping, allowing XSS through any autocomplete field displaying entity names.\n\nAn **authenticated administrator** can inject arbitrary HTML or JavaScript via entity names (e.g. taxon name) that is persistently rendered for all users.\n\n### Patches\n\nThe issue is fixed in versions: 2.0.16, 2.1.12, 2.2.3 and above.\n\n### Workarounds\n\nOverride vulnerable templates and JavaScript controllers at the project level.\n\n---\n\n#### Step 1 — Override shop breadcrumbs template\n\n`templates/bundles/SyliusShopBundle/shared/breadcrumbs.html.twig`:\n\n```twig\n{% macro breadcrumbs(items) %}\n    <ol class=\"breadcrumb\" aria-label=\"breadcrumbs\">\n        {% for item in items %}\n            <li class=\"breadcrumb-item fw-normal{{ item.active is defined and item.active ? ' active' }}\">\n                {% if item.path is defined %}\n                    <a class=\"link-reset\" href=\"{{ item.path }}\" {{ item.test_attribute is defined ? sylius_test_html_attribute(item.test_attribute) }}>{{ item.label }}</a>\n                {% else %}\n                    <span class=\"text-body-tertiary text-break\" {{ item.test_attribute is defined ? sylius_test_html_attribute(item.test_attribute) }}>{{ item.label }}</span>\n                {% endif %}\n            </li>\n        {% endfor %}\n    </ol>\n{% endmacro %}\n```\n\n#### Step 2 — Override order breadcrumbs template\n\n`templates/bundles/SyliusShopBundle/account/order/show/content/breadcrumbs.html.twig`:\n\n```twig\n{% from '@SyliusShop/shared/breadcrumbs.html.twig' import breadcrumbs as breadcrumbs %}\n\n{% set order = hookable_metadata.context.order %}\n\n<div class=\"col-12\">\n    {{ breadcrumbs([\n        { label: 'sylius.ui.home'|trans, path: path('sylius_shop_homepage')},\n        { label: 'sylius.ui.my_account'|trans, path: path('sylius_shop_account_dashboard')},\n        { label: 'sylius.ui.order_history'|trans, path: path('sylius_shop_account_order_index')},\n        { label: '#'~order.number, active: true, test_attribute: 'order-number' }\n    ]) }}\n</div>\n```\n\n#### Step 3 — Override ProductTaxonTreeController.js\n\nDisable the vendor controller in `assets/admin/controllers.json`:\n\n```diff\n  \"product-taxon-tree\": {\n-   \"enabled\": true,\n+   \"enabled\": false,\n    \"fetch\": \"lazy\"\n  },\n```\n\nCreate `assets/admin/controllers/product_taxon_tree_controller.js` — copy the original from `vendor/sylius/sylius/src/Sylius/Bundle/AdminBundle/Resources/assets/controllers/ProductTaxonTreeController.js` and apply the following change:\n\n```diff\n+ const escapeHtml = (str) => {\n+     const div = document.createElement('div');\n+     div.textContent = str;\n+     return div.innerHTML;\n+ };\n\n  // in rowRenderer:\n- <span class=\"infinite-tree-title\">${name}</span>\n+ <span class=\"infinite-tree-title\">${escapeHtml(name)}</span>\n```\n\nRegister the patched controller in `assets/admin/bootstrap.js`:\n\n```js\nimport ProductTaxonTreeController from './controllers/product_taxon_tree_controller';\napp.register('sylius--admin-bundle--product-taxon-tree', ProductTaxonTreeController);\n```\n\n#### Step 4 — Add autocomplete XSS protection\n\n`assets/admin/scripts/autocomplete-xss-protection.js`:\n\n```js\nconst escapeHtml = (str) => {\n    if (typeof str !== 'string') return str;\n    const div = document.createElement('div');\n    div.textContent = str;\n    return div.innerHTML;\n};\n\ndocument.addEventListener('autocomplete:pre-connect', (event) => {\n    const options = event.detail.options;\n    if (!options.render) return;\n\n    const labelField = options.labelField || 'text';\n    const wrapRenderer = (renderer) => {\n        if (!renderer) return renderer;\n        return (data, escape) => {\n            const escaped = { ...data };\n            if (escaped[labelField]) {\n                escaped[labelField] = escapeHtml(escaped[labelField]);\n            }\n            return renderer(escaped, escape);\n        };\n    };\n\n    if (options.render.item) options.render.item = wrapRenderer(options.render.item);\n    if (options.render.option) options.render.option = wrapRenderer(options.render.option);\n});\n```\n\nImport in `assets/admin/entrypoint.js` **before** bootstrap:\n\n```diff\n+ import './scripts/autocomplete-xss-protection';\n  import './bootstrap.js';\n```\n\n#### Step 5 — Rebuild assets\n\n```bash\nyarn encore dev  # or: yarn encore production\n```\n\n### Reporters\n\nWe would like to extend our gratitude to the following individuals for their detailed reporting and responsible disclosure of this vulnerability:\n- Djibril Mounkoro (@whiteov3rflow)\n- Bartłomiej Nowiński (@bnBart)\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n- Open an issue in [Sylius issues](https://github.com/Sylius/Sylius/issues?q=sort%3Aupdated-desc+is%3Aissue+is%3Aopen)\n- Email us at [security@sylius.com](mailto:security@sylius.com)","severity":"medium","score":4.8,"published":"2026-03-11T00:13:20.000Z","modified":"2026-03-13T10:56:24.260Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"sylius/sylius","sources":[{"name":"OSV · GHSA-mx4q-xxc9-pf5q","url":"https://osv.dev/vulnerability/GHSA-mx4q-xxc9-pf5q"}],"ranges":[{"events":[{"introduced":"2.0.0"},{"fixed":"2.0.16"}],"type":"ECOSYSTEM"}],"versions":["v2.0.0","v2.0.1","v2.0.10","v2.0.11","v2.0.12","v2.0.13","v2.0.14","v2.0.15","v2.0.2","v2.0.3","v2.0.4","v2.0.5","v2.0.6","v2.0.7","v2.0.8","v2.0.9"],"fixed":["2.0.16"]},{"ecosystem":"Packagist","name":"sylius/sylius","sources":[{"name":"OSV · GHSA-mx4q-xxc9-pf5q","url":"https://osv.dev/vulnerability/GHSA-mx4q-xxc9-pf5q"}],"ranges":[{"events":[{"introduced":"2.1.0"},{"fixed":"2.1.12"}],"type":"ECOSYSTEM"}],"versions":["v2.1.0","v2.1.1","v2.1.10","v2.1.11","v2.1.2","v2.1.3","v2.1.4","v2.1.5","v2.1.6","v2.1.7","v2.1.8","v2.1.9"],"fixed":["2.1.12"]},{"ecosystem":"Packagist","name":"sylius/sylius","sources":[{"name":"OSV · GHSA-mx4q-xxc9-pf5q","url":"https://osv.dev/vulnerability/GHSA-mx4q-xxc9-pf5q"}],"ranges":[{"events":[{"introduced":"2.2.0"},{"fixed":"2.2.3"}],"type":"ECOSYSTEM"}],"versions":["v2.2.0","v2.2.1","v2.2.2"],"fixed":["2.2.3"]}],"sourceAffected":[],"references":["https://github.com/Sylius/Sylius/security/advisories/GHSA-mx4q-xxc9-pf5q","https://nvd.nist.gov/vuln/detail/CVE-2026-31823","https://github.com/Sylius/Sylius"],"sources":[{"name":"OSV","id":"GHSA-mx4q-xxc9-pf5q","modified":"2026-03-13T10:56:24.260023Z","url":"https://osv.dev/vulnerability/GHSA-mx4q-xxc9-pf5q"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","score":4.8}],"products":[],"remediation":[],"kev":{"status":"not-listed","checkedAt":"2026-10-29T03:30:33.923Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}