CVE-2023-41336
Prevent injection of invalid entity ids for "autocomplete" fields in symfony ux-autocomplete
ux-autocomplete is a JavaScript Autocomplete functionality for Symfony. Under certain circumstances, an attacker could successfully submit an entity id for an EntityType that is not part of the valid choices. The problem has been fixed in symfony/ux-autocomplete version 2.11.2.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Prevent injection of invalid entity ids for "autocomplete" fields in symfony ux-autocomplete
ux-autocomplete is a JavaScript Autocomplete functionality for Symfony. Under certain circumstances, an attacker could successfully submit an entity id for an EntityType that is not part of the valid choices. The problem has been fixed in symfony/ux-autocomplete version 2.11.2.
- Record
CVE-2023-41336- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
EUVDEUVD-2023-2415
ux-autocomplete is a JavaScript Autocomplete functionality for Symfony. Under certain circumstances, an attacker could successfully submit an entity id for an EntityType that is not part of the valid choices. The problem has been fixed in symfony/ux-autocomplete version 2.11.2.
- Record
EUVD-2023-2415- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4cpv-669c-r79x
Prevent injection of invalid entity ids for "autocomplete" fields
Impact
Under certain circumstances, an attacker could successfully submit an entity id for an EntityType that is not part of the valid choices.
Affected applications are any that use:
- A custom
query_builderoption to limit the valid results; AND - An
EntityTypewith'autocomplete' => trueor a custom AsEntityAutocompleteField.
Under this circumstance, if an id is submitted, it is accepted even if the matching record would not be returned by the custom query built with query_builder.
Patches
The problem has been fixed in symfony/ux-autocomplete version 2.11.2.
Workarounds
Upgrade to version 2.11.2 or greater of symfony/ux-autocomplete or perform extra validation after submit to verify the selected option is valid.
- Record
GHSA-4cpv-669c-r79x- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
NVD
ux-autocomplete is a JavaScript Autocomplete functionality for Symfony. Under certain circumstances, an attacker could successfully submit an entity id for an EntityType that is not part of the valid choices. The problem has been fixed in symfony/ux-autocomplete version 2.11.2.
- Record
CVE-2023-41336- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
OSV
Prevent injection of invalid entity ids for "autocomplete" fields in symfony ux-autocomplete
ux-autocomplete is a JavaScript Autocomplete functionality for Symfony. Under certain circumstances, an attacker could successfully submit an entity id for an EntityType that is not part of the valid choices. The problem has been fixed in symfony/ux-autocomplete version 2.11.2.
- Record
CVE-2023-41336- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVGHSA-4cpv-669c-r79x
Prevent injection of invalid entity ids for "autocomplete" fields
Impact
Under certain circumstances, an attacker could successfully submit an entity id for an EntityType that is not part of the valid choices.
Affected applications are any that use:
- A custom
query_builderoption to limit the valid results; AND - An
EntityTypewith'autocomplete' => trueor a custom AsEntityAutocompleteField.
Under this circumstance, if an id is submitted, it is accepted even if the matching record would not be returned by the custom query built with query_builder.
Patches
The problem has been fixed in symfony/ux-autocomplete version 2.11.2.
Workarounds
Upgrade to version 2.11.2 or greater of symfony/ux-autocomplete or perform extra validation after submit to verify the selected option is valid.
- Record
GHSA-4cpv-669c-r79x- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
symfony/ux-autocompletePackagist |
before 2.11.2 | 2.11.2 |
symfony/ux-autocompletePackagist |
before 2.11.2, plus listed versions v2.10.0v2.11.0v2.11.1v2.2.0v2.3.0 Show 10 moreShow lessv2.4.0v2.5.0v2.6.0v2.6.1v2.7.0v2.7.1v2.8.0v2.8.1v2.9.0v2.9.1 |
2.11.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-41336 is a medium vulnerability (CVSS 6.5) in Symfony Ux-autocomplete, published September 11, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.64%, the 50th percentile. Fixed in symfony/ux-autocomplete 2.11.2.
References
github.com/symfony/ux-autocomplete/security/advisories/GHSA-4cpv-669c-r79x
symfony.com/bundles/ux-autocomplete/current/index.html
nvd.nist.gov/vuln/detail/CVE-2023-41336