CVE-2019-12186
XSS injection in the Grid component of Sylius
An issue was discovered in Sylius products. Missing input sanitization in sylius/sylius 1.0.x through 1.0.18, 1.1.x through 1.1.17, 1.2.x through 1.2.16, 1.3.x through 1.3.11, and 1.4.x through 1.4.3 and sylius/grid 1.0.x through 1.0.18, 1.1.x through 1.1.18, 1.2.x through 1.2.17, 1.3.x through 1.3.12, 1.4.x through 1.4.4, and 1.5.0 allows an attacker (an admin in the sylius/sylius case) to perform XSS by injecting malicious code into a field displayed in a grid with the "string" field type. The contents are an object, with malicious code returned by the __toString() method of that object.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
An issue was discovered in Sylius products. Missing input sanitization in sylius/sylius 1.0.x through 1.0.18, 1.1.x through 1.1.17, 1.2.x through 1.2.16, 1.3.x through 1.3.11, and 1.4.x through 1.4.3 and sylius/grid 1.0.x through 1.0.18, 1.1.x through 1.1.18, 1.2.x through 1.2.17, 1.3.x through 1.3.12, 1.4.x through 1.4.4, and 1.5.0 allows an attacker (an admin in the sylius/sylius case) to perform XSS by injecting malicious code into a field displayed in a grid with the "string" field type. The contents are an object, with malicious code returned by the __toString() method of that object.
- Record
CVE-2019-12186- CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 3.5 Low
AV:N/AC:M/Au:S/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
An issue was discovered in Sylius products. Missing input sanitization in sylius/sylius 1.0.x through 1.0.18, 1.1.x through 1.1.17, 1.2.x through 1.2.16, 1.3.x through 1.3.11, and 1.4.x through 1.4.3 and sylius/grid 1.0.x through 1.0.18, 1.1.x through 1.1.18, 1.2.x through 1.2.17, 1.3.x through 1.3.12, 1.4.x through 1.4.4, and 1.5.0 allows an attacker (an admin in the sylius/sylius case) to perform XSS by injecting malicious code into a field displayed in a grid with the "string" field type. The contents are an object, with malicious code returned by the __toString() method of that object.
- Record
CVE-2019-12186- Updated
- 2026-11-02
EUVDEUVD-2020-0393 No score
An issue was discovered in Sylius products. Missing input sanitization in sylius/sylius 1.0.x through 1.0.18, 1.1.x through 1.1.17, 1.2.x through 1.2.16, 1.3.x through 1.3.11, and 1.4.x through 1.4.3 and sylius/grid 1.0.x through 1.0.18, 1.1.x through 1.1.18, 1.2.x through 1.2.17, 1.3.x through 1.3.12, 1.4.x through 1.4.4, and 1.5.0 allows an attacker (an admin in the sylius/sylius case) to perform XSS by injecting malicious code into a field displayed in a grid with the "string" field type. The contents are an object, with malicious code returned by the __toString() method of that object.
- Record
EUVD-2020-0393- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rc5r-697f-28x6
XSS injection in the Grid component of Sylius
Grid component of Sylius omits HTML input sanitisation while rendering object implementing __toString() method through the string field type.
- Record
GHSA-rc5r-697f-28x6- CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
An issue was discovered in Sylius products. Missing input sanitization in sylius/sylius 1.0.x through 1.0.18, 1.1.x through 1.1.17, 1.2.x through 1.2.16, 1.3.x through 1.3.11, and 1.4.x through 1.4.3 and sylius/grid 1.0.x through 1.0.18, 1.1.x through 1.1.18, 1.2.x through 1.2.17, 1.3.x through 1.3.12, 1.4.x through 1.4.4, and 1.5.0 allows an attacker (an admin in the sylius/sylius case) to perform XSS by injecting malicious code into a field displayed in a grid with the "string" field type. The contents are an object, with malicious code returned by the __toString() method of that object.
- Record
CVE-2019-12186- CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-rc5r-697f-28x6
XSS injection in the Grid component of Sylius
Grid component of Sylius omits HTML input sanitisation while rendering object implementing __toString() method through the string field type.
- Record
GHSA-rc5r-697f-28x6- CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
sylius/gridPackagist |
1.0.0 up to 1.1.19 | 1.1.19 |
sylius/gridPackagist |
1.2.0 up to 1.2.18 | 1.2.18 |
sylius/gridPackagist |
1.3.0 up to 1.3.13 | 1.3.13 |
sylius/gridPackagist |
1.4.0 up to 1.4.5 | 1.4.5 |
sylius/gridPackagist |
1.5.0 up to 1.5.1 | 1.5.1 |
sylius/grid-bundlePackagist |
1.0.0 up to 1.1.19 | 1.1.19 |
sylius/grid-bundlePackagist |
1.2.0 up to 1.2.18 | 1.2.18 |
sylius/grid-bundlePackagist |
1.3.0 up to 1.3.13 | 1.3.13 |
sylius/grid-bundlePackagist |
1.4.0 up to 1.4.5 | 1.4.5 |
sylius/grid-bundlePackagist |
1.5.0 up to 1.5.1 | 1.5.1 |
Show 18 moreShow less
| Package | Affected | Fixed |
|---|---|---|
sylius/syliusPackagist |
1.0.0 up to 1.1.18 | 1.1.18 |
sylius/syliusPackagist |
1.2.0 up to 1.2.17 | 1.2.17 |
sylius/syliusPackagist |
1.3.0 up to 1.3.12 | 1.3.12 |
sylius/syliusPackagist |
1.4.0 up to 1.4.4 | 1.4.4 |
sylius/gridPackagist |
1.0.0 up to 1.1.19, plus listed versions v1.0.0v1.0.1v1.0.10v1.0.11v1.0.12 Show 33 moreShow lessv1.0.13v1.0.14v1.0.15v1.0.16v1.0.17v1.0.18v1.0.2v1.0.3v1.0.4v1.0.5v1.0.6v1.0.7v1.0.8v1.0.9v1.1.0v1.1.0-RCv1.1.1v1.1.10v1.1.11v1.1.12v1.1.13v1.1.14v1.1.15v1.1.17v1.1.18v1.1.2v1.1.3v1.1.4v1.1.5v1.1.6v1.1.7v1.1.8v1.1.9 |
1.1.19 |
sylius/gridPackagist |
1.2.0 up to 1.2.18, plus listed versions v1.2.0v1.2.1v1.2.10v1.2.11v1.2.12 Show 13 moreShow lessv1.2.13v1.2.14v1.2.15v1.2.16v1.2.17v1.2.2v1.2.3v1.2.4v1.2.5v1.2.6v1.2.7v1.2.8v1.2.9 |
1.2.18 |
sylius/gridPackagist |
1.3.0 up to 1.3.13, plus listed versions v1.3.0v1.3.1v1.3.10v1.3.11v1.3.12 Show 8 moreShow lessv1.3.2v1.3.3v1.3.4v1.3.5v1.3.6v1.3.7v1.3.8v1.3.9 |
1.3.13 |
sylius/gridPackagist |
1.4.0 up to 1.4.5, plus listed versions v1.4.0v1.4.1v1.4.2v1.4.3v1.4.4 |
1.4.5 |
sylius/gridPackagist |
1.5.0 up to 1.5.1, plus listed versions v1.5.0 |
1.5.1 |
sylius/grid-bundlePackagist |
1.0.0 up to 1.1.19, plus listed versions 1.0.0-patch1v1.0.0v1.0.1v1.0.10v1.0.11 Show 34 moreShow lessv1.0.12v1.0.13v1.0.14v1.0.15v1.0.16v1.0.17v1.0.18v1.0.2v1.0.3v1.0.4v1.0.5v1.0.6v1.0.7v1.0.8v1.0.9v1.1.0v1.1.0-RCv1.1.1v1.1.10v1.1.11v1.1.12v1.1.13v1.1.14v1.1.15v1.1.17v1.1.18v1.1.2v1.1.3v1.1.4v1.1.5v1.1.6v1.1.7v1.1.8v1.1.9 |
1.1.19 |
sylius/grid-bundlePackagist |
1.2.0 up to 1.2.18, plus listed versions 1.2.4-patch1v1.2.0v1.2.1v1.2.10v1.2.11 Show 14 moreShow lessv1.2.12v1.2.13v1.2.14v1.2.15v1.2.16v1.2.17v1.2.2v1.2.3v1.2.4v1.2.5v1.2.6v1.2.7v1.2.8v1.2.9 |
1.2.18 |
sylius/grid-bundlePackagist |
1.3.0 up to 1.3.13, plus listed versions v1.3.0v1.3.1v1.3.10v1.3.11v1.3.12 Show 8 moreShow lessv1.3.2v1.3.3v1.3.4v1.3.5v1.3.6v1.3.7v1.3.8v1.3.9 |
1.3.13 |
sylius/grid-bundlePackagist |
1.4.0 up to 1.4.5, plus listed versions 1.4.0-patch1v1.4.0v1.4.1v1.4.2v1.4.3v1.4.4 |
1.4.5 |
sylius/grid-bundlePackagist |
1.5.0 up to 1.5.1, plus listed versions v1.5.0 |
1.5.1 |
sylius/syliusPackagist |
1.0.0 up to 1.1.18, plus listed versions v1.0.0v1.0.1v1.0.10v1.0.11v1.0.12 Show 33 moreShow lessv1.0.13v1.0.14v1.0.15v1.0.16v1.0.17v1.0.18v1.0.2v1.0.3v1.0.4v1.0.5v1.0.6v1.0.7v1.0.8v1.0.9v1.1.0v1.1.0-RCv1.1.1v1.1.10v1.1.11v1.1.12v1.1.13v1.1.14v1.1.15v1.1.16v1.1.17v1.1.2v1.1.3v1.1.4v1.1.5v1.1.6v1.1.7v1.1.8v1.1.9 |
1.1.18 |
sylius/syliusPackagist |
1.2.0 up to 1.2.17, plus listed versions v1.2.0v1.2.1v1.2.10v1.2.11v1.2.12 Show 12 moreShow lessv1.2.13v1.2.14v1.2.15v1.2.16v1.2.2v1.2.3v1.2.4v1.2.5v1.2.6v1.2.7v1.2.8v1.2.9 |
1.2.17 |
sylius/syliusPackagist |
1.3.0 up to 1.3.12, plus listed versions v1.3.0v1.3.1v1.3.10v1.3.11v1.3.2 Show 7 moreShow lessv1.3.3v1.3.4v1.3.5v1.3.6v1.3.7v1.3.8v1.3.9 |
1.3.12 |
sylius/syliusPackagist |
1.4.0 up to 1.4.4, plus listed versions v1.4.0v1.4.1v1.4.2v1.4.3 |
1.4.4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-12186 is a medium vulnerability (CVSS 4.8) in Sylius Grid, published December 31, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.55%, the 46th percentile. Fixed in sylius/grid 1.1.19.