Symfony UX, a JavaScript ecosystem for Symfony, contains a vulnerability in the LiveComponentHydrator::hydrateObjectValue() method. For #[LiveProp] properties typed as DateTimeInterface without an explicit format, the method uses new $className($value) to hydrate the value. This allows client-supplied relative date strings (e.g., 'now', 'tomorrow', '+10 years') to be interpreted as valid DateTime objects, potentially bypassing time-based business logic validations. The vulnerability affects versions from 2.8.0 until 2.36.0 and 3.1.0, and is resolved in versions 2.36.0 and 3.1.0.

An attacker can supply relative date strings to manipulate writable date properties, potentially bypassing time-based business logic checks. This could lead to unauthorized actions or logic bypasses dependent on date validation. The CVSS 4.0 score is 6.9 (medium severity), indicating a network exploitable vulnerability with no privileges or user interaction required and limited impact on integrity.

Upgrade to Symfony UX versions 2.36.0 or 3.1.0 or later where this vulnerability is fixed. No other mitigation or temporary workaround is indicated in the available data. Patch status is confirmed fixed in these versions.