4.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-31823

CVE-2026-31823: Sylius Vulnerable to Authenticated Stored XSS

Impact

An authenticated stored cross-site scripting (XSS) vulnerability exists in multiple places across the shop frontend and admin panel due to unsanitized entity names being rendered as raw HTML.

Shop breadcrumbs (shared/breadcrumbs.html.twig): The breadcrumbs macro uses the Twig |raw filter on label values. Since taxon names, product names, and ancestor names flow directly into these labels, a malicious taxon name like <img src=x onerror=alert('XSS')> is rendered and executed as JavaScript on the storefront.

Admin product taxon picker (ProductTaxonTreeController.js): The rowRenderer method interpolates ${name} directly into a template literal building HTML, allowing script injection through taxon names in the admin panel.

Admin autocomplete fields (Tom Select): Dropdown items and options render entity names as raw HTML without escaping, allowing XSS through any autocomplete field displaying entity names.

An authenticated administrator can inject arbitrary HTML or JavaScript via entity names (e.g. taxon name) that is persistently rendered for all users.

Patches

The issue is fixed in versions: 2.0.16, 2.1.12, 2.2.3 and above.

Workarounds

Override vulnerable templates and JavaScript controllers at the project level.

Step 1 — Override shop breadcrumbs template

templates/bundles/SyliusShopBundle/shared/breadcrumbs.html.twig:

{% macro breadcrumbs(items) %}
    <ol class="breadcrumb" aria-label="breadcrumbs">
        {% for item in items %}
            <li class="breadcrumb-item fw-normal{{ item.active is defined and item.active ? ' active' }}">
                {% if item.path is defined %}
                    <a class="link-reset" href="{{ item.path }}" {{ item.test_attribute is defined ? sylius_test_html_attribute(item.test_attribute) }}>{{ item.label }}</a>
                {% else %}
                    <span class="text-body-tertiary text-break" {{ item.test_attribute is defined ? sylius_test_html_attribute(item.test_attribute) }}>{{ item.label }}</span>
                {% endif %}
            </li>
        {% endfor %}
    </ol>
{% endmacro %}

Miggo Vulnerability Database

→

CVE-2026-31823

CVE-2026-31823:

4.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
sylius/sylius	composer	>= 2.0.0, <= 2.0.15	2.0.16
sylius/sylius	composer	>= 2.1.0, <= 2.1.11	2.1.12
sylius/sylius	composer	>= 2.2.0, <= 2.2.2	2.2.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a stored Cross-Site Scripting (XSS) issue present in multiple parts of the Sylius application. The root cause is the rendering of unsanitized data, such as product names, taxon names, and error messages, as raw HTML. I analyzed the commits between the vulnerable version v2.2.2 and the patched version v2.2.3. The commits clearly show the fixes for these vulnerabilities.

Shop Breadcrumbs: The |raw filter was removed from the Twig template src/Sylius/Bundle/ShopBundle/templates/shared/breadcrumbs.html.twig. This filter was allowing HTML from entity names to be rendered directly, causing an XSS vulnerability.
Admin Taxon Tree: In src/Sylius/Bundle/AdminBundle/Resources/assets/controllers/ProductTaxonTreeController.js, the rowRenderer method was constructing HTML strings with unescaped taxon names. The patch introduces an escapeHtml function to sanitize the names before they are rendered.
Admin Autocomplete Fields: A new script, src/Sylius/Bundle/AdminBundle/Resources/assets/scripts/autocomplete-xss-protection.js, was added to globally patch the autocomplete component (Tom Select). It wraps the item and option renderers to escape the displayed labels, preventing XSS in all autocomplete fields.
API Login Controller: In src/Sylius/Bundle/ShopBundle/Resources/assets/controllers/ApiLoginController.js, an error message from the server was being set using innerHTML. The patch changes this to textContent to prevent any HTML in the error message from being executed.

By identifying these changes, I was able to pinpoint the exact functions and templates that were vulnerable.

Vulnerable functions

breadcrumbs

src/Sylius/Bundle/ShopBundle/templates/shared/breadcrumbs.html.twig

The `breadcrumbs` macro in `src/Sylius/Bundle/ShopBundle/templates/shared/breadcrumbs.html.twig` used the `|raw` filter on `item.label`. This allowed for the rendering of unescaped HTML, leading to a stored XSS vulnerability when a malicious value (like a product or taxon name) was passed as a label.

ProductTaxonTreeController.rowRenderer

src/Sylius/Bundle/AdminBundle/Resources/assets/controllers/ProductTaxonTreeController.js

The `rowRenderer` method in `ProductTaxonTreeController.js` constructed HTML by directly interpolating the `name` variable. This allowed for arbitrary HTML and script injection through a malicious taxon name, leading to a stored XSS vulnerability in the admin panel.

TaxonTreeController.rowRenderer

src/Sylius/Bundle/AdminBundle/Resources/assets/controllers/TaxonTreeController.js

The `rowRenderer` method in `TaxonTreeController.js` was vulnerable to XSS. The patch modifies the rendering logic to use `textContent` to safely set the taxon name, preventing the execution of injected scripts.

ApiLoginController.login

src/Sylius/Bundle/ShopBundle/Resources/assets/controllers/ApiLoginController.js

In the `login` method of `ApiLoginController.js`, the error message from the API response was assigned to the `innerHTML` of an element. This could lead to an XSS vulnerability if the error message contained malicious HTML. The patch fixes this by using `textContent` instead.

wrapRenderer

src/Sylius/Bundle/AdminBundle/Resources/assets/scripts/autocomplete-xss-protection.js

The `wrapRenderer` function was introduced to patch the autocomplete functionality. It wraps the original `item` and `option` renderers to escape HTML in the label field before rendering, thus preventing XSS in autocomplete fields across the admin panel.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

4.8

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-31823: Sylius Vulnerable to Authenticated Stored XSS

Impact

Patches

Workarounds

Step 1 — Override shop breadcrumbs template

CVE-2026-31823:

4.8

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

4.8

4.8

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Basic Information

Basic Information

CVE-2026-31823: Sylius Vulnerable to Authenticated Stored XSS

Impact

Patches

Workarounds

Step 1 — Override shop breadcrumbs template

Step 2 — Override order breadcrumbs template

Step 3 — Override ProductTaxonTreeController.js

Step 4 — Add autocomplete XSS protection

Step 5 — Rebuild assets

Reporters

For more information

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI