Moderate severityNVD Advisory· Published Mar 10, 2026· Updated Mar 11, 2026
Sylius has a XSS vulnerability in checkout login form
CVE-2026-31822
Description
Sylius is an Open Source eCommerce Framework on Symfony. A cross-site scripting (XSS) vulnerability exists in the shop checkout login form handled by the ApiLoginController Stimulus controller. When a login attempt fails, AuthenticationFailureHandler returns a JSON response whose message field is rendered into the DOM using innerHTML, allowing any HTML or JavaScript in that value to be parsed and executed by the browser. The issue is fixed in versions: 2.0.16, 2.1.12, 2.2.3 and above.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
sylius/syliusPackagist | >= 2.0.0, < 2.0.16 | 2.0.16 |
sylius/syliusPackagist | >= 2.1.0, < 2.1.12 | 2.1.12 |
sylius/syliusPackagist | >= 2.2.0, < 2.2.3 | 2.2.3 |
Affected products
2Patches
Vulnerability mechanics
References
3- github.com/advisories/GHSA-vgh8-c6fp-7gcgghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-31822ghsaADVISORY
- github.com/Sylius/Sylius/security/advisories/GHSA-vgh8-c6fp-7gcgghsax_refsource_CONFIRMWEB
News mentions
0No linked articles in our index yet.