Symfony UX's symfony/ux-autocomplete Stimulus controller improperly neutralizes input during web page generation in the _createAutocompleteWithRemoteData() function. It renders AJAX response items by interpolating the text field directly into HTML template literals (<div>${item[labelField]}</div>) instead of safely encoding it as text. This allows attacker-controlled markup from user-supplied dropdown values to execute in the browser of any user who opens an autocomplete widget backed by the same data. The vulnerability affects versions >=2.2.0 <2.36.0 and >=3.0.0 <3.1.0 and is fixed in versions 2.36.0 and 3.1.0.

An attacker can inject malicious markup via user-supplied dropdown values in the autocomplete widget, leading to cross-site scripting (XSS) attacks. This can result in execution of arbitrary scripts in the context of the affected user's browser, potentially leading to session hijacking, data theft, or other malicious actions. The vulnerability requires user interaction (opening the autocomplete widget) and does not require privileges or authentication.

Upgrade symfony/ux-autocomplete to version 2.36.0 or later, or 3.1.0 or later, where the vulnerability is fixed. No other official remediation or temporary fixes are documented. Patch status is not explicitly stated but the fix is included in these versions. Users should prioritize updating to these fixed versions to mitigate the risk.