Symfony UX LiveComponent rendering is affected because the createHtml() function interpolates the client‑controlled children[id].tag value directly into the HTML as a tag name without escaping or validation. This allows an attacker to supply arbitrary HTML, such as <script> tags, so that any LiveComponent re‑render containing at least one child component can inject malicious content. The injected code is reflected in the users’ browsers, providing a client‑side XSS vector.

Any application using Symfony/UX library version 2.8.0 through 2.35.x, or any 3.0.x release, where LiveComponentSubscriber and InterceptChildComponentRenderSubscriber are active is vulnerable. The issue is fixed in library releases 2.36.0 and 3.1.0.

The vulnerability has a CVSS score of 2.3 and an EPSS score of less than 1 %. It is not listed in the CISA KEV catalog. Based on the description, it is inferred that exploitation requires an attacker to control the child component tag value that will be rendered; this is usually possible via user input that triggers a LiveComponent re‑render. Because the attack only injects client‑side code, the impact is limited to victim browsers and is mitigated by applying the fix or validating the tag name.