Sylius has a XSS vulnerability in checkout login form

Vulnerability

Overview

CVE-2026-31822 is a cross-site scripting (XSS) vulnerability in the Sylius eCommerce framework affecting the shop checkout login form. The root cause is that the AuthenticationFailureHandler returns a JSON response whose message field is injected into the Document Object Model (DOM) using innerHTML [2]. This direct assignment of server-returned content to innerHTML violates defense-in-depth principles by allowing any HTML or JavaScript present in the message value to be parsed and executed by the browser [1][2].

Attack

Vector and Exploitation

The message value originates from AuthenticationException::getMessageKey(), passed through Symfony's translator using the request locale. In a default Sylius installation, this string is a hardcoded translation key (e.g., "Invalid credentials.") and is not directly user-controlled [2]. However, the risk escalates significantly under several realistic scenarios: if a project overrides the authentication handler to include user-supplied data (e.g., a custom message like "No account found for {username}"), if translation files are sourced from an untrusted database or CMS, if a Man-in-the-Middle (MitM) attacker intercepts the HTTP response, or if any middleware or reverse proxy modifies the JSON body [2]. No privileged access or authentication is required to trigger the vulnerability—an attacker can simply submit crafted credentials to the checkout login endpoint [2].

Impact

Successful exploitation could lead to session hijacking, credential theft, cart or order manipulation, or phishing attacks within the trusted shop domain [2]. Because the injected script executes in the context of the legitimate e-commerce site, an attacker can silently exfiltrate sensitive data entered by the victim on subsequent pages.

Mitigation and

Remediation

The Sylius project has released patches in versions 2.0.16, 2.1.12, and 2.2.3 that fix the vulnerability by avoiding the use of innerHTML for rendering the error message [1][2]. Users are strongly advised to upgrade to one of the patched versions. As a workaround, site administrators can override the vulnerable JavaScript controller (ApiLoginController.js) at the project level to sanitize or safely insert the message content [2].