Cross-Site Scripting Vulnerability in Sylius eCommerce Framework
CVE-2026-31823
What is CVE-2026-31823?
An authenticated stored cross-site scripting (XSS) vulnerability has been identified in the Sylius eCommerce Framework. This issue arises from unsanitized entity names being rendered as raw HTML within various components of the application, including the shop frontend and admin panel. Attackers can exploit this vulnerability by injecting malicious JavaScript into taxon names, product names, and other entity labels, which are then executed in the context of users visiting the site. For instance, the breadcrumbs macro improperly uses the Twig |raw filter, allowing attackers to craft harmful inputs that lead to script execution. Similarly, the admin product taxon picker and autocomplete fields facilitate the injection of unsafe HTML and JavaScript, compromising the system's security. Administrators are urged to update to the latest versions to mitigate these risks.
Affected Version(s)
Sylius >= 2.2.0, < 2.2.3 < 2.2.0, 2.2.3
Sylius >= 2.1.0, < 2.1.12 < 2.1.0, 2.1.12
Sylius >= 2.0.0, < 2.0.16 < 2.0.0, 2.0.16