The vulnerability resides in the Symfony UX autocomplete component, specifically within the _createAutocompleteWithRemoteData method of symfony/ux‑autocomplete. The method renders AJAX response items by interpolating the supplied label field into HTML template literals (<div>${item[labelField]}</div>) rather than escaping it. Because the injected value comes from user‑supplied dropdown data, an attacker who can influence that data can insert arbitrary HTML or JavaScript that will be executed in the browsers of any user who opens the autocomplete widget. This client‑side injection flaw is classified as CWE‑79 and was remedied in releases 2.36.0 and 3.1.0, which now escape the label before rendering.

The vulnerability resides in the Autocomplete component of Symfony UX (symfony/ux‑autocomplete). Versions starting with 2.2.0 and up through 2.35.x, as well as the 3.x lineage prior to 3.1.0, contain the flaw. The patch that removes the vulnerability is delivered in releases 2.36.0 and 3.1.0, which should be used instead.

The CVSS score of 5.1 classifies this issue as moderate severity. The EPSS score is below 1 %, indicating a low likelihood of exploitation at present, and it is not listed in the CISA KEV catalog. An attacker’s ability to exploit it depends on control over the data supplied to the autocomplete; if the data source can be compromised, the attacker can inject arbitrary markup that will run in the browsers of all users who view the widget.