Sylius Vulnerable to Authenticated Stored XSS
Date: 2026-03
Affected: composer/sylius/sylius, composer/sylius/sylius, composer/sylius/sylius
Attack vector: xss
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2026-31823
CWE: CWE-79
CVSS: 4.8 (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N)

### Impact An authenticated stored cross-site scripting (XSS) vulnerability exists in multiple places across the shop frontend and admin panel due to unsanitized entity names being rendered as raw HTML. **Shop breadcrumbs** (`shared/breadcrumbs.html.twig`): The `breadcrumbs` macro uses the Twig `|raw` filter on label values. Since taxon names, product names, and ancestor names flow directly into these labels, a malicious taxon name like `<img src=x onerror=alert('XSS')>` is rendered and executed as JavaScript on the storefront. **Admin product taxon picker** (`ProductTaxonTreeController.js`): The `rowRenderer` method interpolates `${name}` directly into a template literal building HTML, allowing script injection through taxon names in the admin panel. **Admin autocomplete fields** (Tom Select): Dropdown items and options render entity names as raw HTML without escaping, allowing XSS through any autocomplete field displaying entity names. An **authenticated administrator** can inject arbitrary HTML or JavaScript via entity names (e.g. taxon name) that is persistently rendered for all users. ### Patches The issue is fixed in versions: 2.0.16, 2.1.12, 2.2.3 and above. ### Workarounds Override vulnerable templates and JavaScript controllers at the project level. --- #### Step 1 — Override shop breadcrumbs template `templates/bundles/SyliusShopBundle/shared/breadcrumbs.html.twig`: ```twig {% macro breadcrumbs(items) %} <ol class="breadcrumb" aria-label="breadcrumb


Mitigations:

Architectural layers (MAESTRO):