CVE-2026-49208

Packagist/symfony/ux-live-component CVE-2026-49208: medium

ux-live-component: Format-less date LiveProps parsed with the permissive DateTime constructor

Action: Upgrade symfony/ux-live-component to 2.36.0 or later.

composer require symfony/ux-live-component:2.36.0

composer require symfony/ux-live-component:3.1.0

Affected

Fixed versions

Sources

• osv: GHSA-89g7-22c8-3j23
• https://github.com/symfony/ux/security/advisories/GHSA-89g7-22c8-3j23
• https://github.com/symfony/ux/commit/d24d78fda6df2d5964312255943ebf3a217b79a2
• https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/ux-live-component/CVE-2026-49208.yaml
• https://github.com/symfony/ux

CVE-2026-49208 · published 2026-06-19T19:23:55Z · modified 2026-09-10T03:50:48.829554222Z · JSON