CVE-2026-49211

Packagist/symfony/ux-autocomplete CVE-2026-49211: medium

symfony/ux-autocomplete: Information exposure via unescaped LIKE wildcards in EntitySearchUtil

Action: Upgrade symfony/ux-autocomplete to 2.36.0 or later.

composer require symfony/ux-autocomplete:2.36.0

composer require symfony/ux-autocomplete:3.1.0

Affected

Fixed versions

Sources

• osv: GHSA-946h-jp5c-8fvh
• https://github.com/symfony/ux/security/advisories/GHSA-946h-jp5c-8fvh
• https://github.com/symfony/ux/commit/725ab3d40689c91ff19ad2d01940a30007769214
• https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/ux-autocomplete/CVE-2026-49211.yaml
• https://github.com/symfony/ux

CVE-2026-49211 · published 2026-06-19T19:34:53Z · modified 2026-09-10T03:50:49.104715683Z · JSON