{"id":"CVE-2019-12186","aliases":["EUVD-2020-0393","GHSA-rc5r-697f-28x6"],"status":"published","title":"XSS injection in the Grid component of Sylius","description":"An issue was discovered in Sylius products. Missing input sanitization in sylius/sylius 1.0.x through 1.0.18, 1.1.x through 1.1.17, 1.2.x through 1.2.16, 1.3.x through 1.3.11, and 1.4.x through 1.4.3 and sylius/grid 1.0.x through 1.0.18, 1.1.x through 1.1.18, 1.2.x through 1.2.17, 1.3.x through 1.3.12, 1.4.x through 1.4.4, and 1.5.0 allows an attacker (an admin in the sylius/sylius case) to perform XSS by injecting malicious code into a field displayed in a grid with the \"string\" field type. The contents are an object, with malicious code returned by the __toString() method of that object.","severity":{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00552,"percentile":0.46403,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2019-12-31T14:21:39Z","modified":"2026-10-24T10:30:44Z","fixes":[{"ecosystem":"Packagist","package":"sylius/grid","fixed_in":["1.1.19","1.2.18","1.3.13","1.4.5","1.5.1"],"sources":["ghsa","osv"]},{"ecosystem":"Packagist","package":"sylius/grid-bundle","fixed_in":["1.1.19","1.2.18","1.3.13","1.4.5","1.5.1"],"sources":["ghsa","osv"]},{"ecosystem":"Packagist","package":"sylius/sylius","fixed_in":["1.1.18","1.2.17","1.3.12","1.4.4"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"sylius/grid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.1.19"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"sylius/grid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.0"},{"fixed":"1.2.18"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"sylius/grid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.0"},{"fixed":"1.3.13"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"sylius/grid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.4.0"},{"fixed":"1.4.5"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"sylius/grid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.5.0"},{"fixed":"1.5.1"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"sylius/grid-bundle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.1.19"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"sylius/grid-bundle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.0"},{"fixed":"1.2.18"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"sylius/grid-bundle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.0"},{"fixed":"1.3.13"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"sylius/grid-bundle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.4.0"},{"fixed":"1.4.5"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"sylius/grid-bundle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.5.0"},{"fixed":"1.5.1"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"sylius/sylius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.1.18"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"sylius/sylius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.0"},{"fixed":"1.2.17"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"sylius/sylius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.0"},{"fixed":"1.3.12"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"sylius/sylius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.4.0"},{"fixed":"1.4.4"}]}]},{"source":"osv","ecosystem":"Packagist","package":"sylius/grid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.1.19"}]}],"versions":["v1.0.0","v1.0.1","v1.0.10","v1.0.11","v1.0.12","v1.0.13","v1.0.14","v1.0.15","v1.0.16","v1.0.17","v1.0.18","v1.0.2","v1.0.3","v1.0.4","v1.0.5","v1.0.6","v1.0.7","v1.0.8","v1.0.9","v1.1.0","v1.1.0-RC","v1.1.1","v1.1.10","v1.1.11","v1.1.12","v1.1.13","v1.1.14","v1.1.15","v1.1.17","v1.1.18","v1.1.2","v1.1.3","v1.1.4","v1.1.5","v1.1.6","v1.1.7","v1.1.8","v1.1.9"]},{"source":"osv","ecosystem":"Packagist","package":"sylius/grid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.0"},{"fixed":"1.2.18"}]}],"versions":["v1.2.0","v1.2.1","v1.2.10","v1.2.11","v1.2.12","v1.2.13","v1.2.14","v1.2.15","v1.2.16","v1.2.17","v1.2.2","v1.2.3","v1.2.4","v1.2.5","v1.2.6","v1.2.7","v1.2.8","v1.2.9"]},{"source":"osv","ecosystem":"Packagist","package":"sylius/grid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.0"},{"fixed":"1.3.13"}]}],"versions":["v1.3.0","v1.3.1","v1.3.10","v1.3.11","v1.3.12","v1.3.2","v1.3.3","v1.3.4","v1.3.5","v1.3.6","v1.3.7","v1.3.8","v1.3.9"]},{"source":"osv","ecosystem":"Packagist","package":"sylius/grid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.4.0"},{"fixed":"1.4.5"}]}],"versions":["v1.4.0","v1.4.1","v1.4.2","v1.4.3","v1.4.4"]},{"source":"osv","ecosystem":"Packagist","package":"sylius/grid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.5.0"},{"fixed":"1.5.1"}]}],"versions":["v1.5.0"]},{"source":"osv","ecosystem":"Packagist","package":"sylius/grid-bundle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.1.19"}]}],"versions":["1.0.0-patch1","v1.0.0","v1.0.1","v1.0.10","v1.0.11","v1.0.12","v1.0.13","v1.0.14","v1.0.15","v1.0.16","v1.0.17","v1.0.18","v1.0.2","v1.0.3","v1.0.4","v1.0.5","v1.0.6","v1.0.7","v1.0.8","v1.0.9","v1.1.0","v1.1.0-RC","v1.1.1","v1.1.10","v1.1.11","v1.1.12","v1.1.13","v1.1.14","v1.1.15","v1.1.17","v1.1.18","v1.1.2","v1.1.3","v1.1.4","v1.1.5","v1.1.6","v1.1.7","v1.1.8","v1.1.9"]},{"source":"osv","ecosystem":"Packagist","package":"sylius/grid-bundle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.0"},{"fixed":"1.2.18"}]}],"versions":["1.2.4-patch1","v1.2.0","v1.2.1","v1.2.10","v1.2.11","v1.2.12","v1.2.13","v1.2.14","v1.2.15","v1.2.16","v1.2.17","v1.2.2","v1.2.3","v1.2.4","v1.2.5","v1.2.6","v1.2.7","v1.2.8","v1.2.9"]},{"source":"osv","ecosystem":"Packagist","package":"sylius/grid-bundle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.0"},{"fixed":"1.3.13"}]}],"versions":["v1.3.0","v1.3.1","v1.3.10","v1.3.11","v1.3.12","v1.3.2","v1.3.3","v1.3.4","v1.3.5","v1.3.6","v1.3.7","v1.3.8","v1.3.9"]},{"source":"osv","ecosystem":"Packagist","package":"sylius/grid-bundle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.4.0"},{"fixed":"1.4.5"}]}],"versions":["1.4.0-patch1","v1.4.0","v1.4.1","v1.4.2","v1.4.3","v1.4.4"]},{"source":"osv","ecosystem":"Packagist","package":"sylius/grid-bundle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.5.0"},{"fixed":"1.5.1"}]}],"versions":["v1.5.0"]},{"source":"osv","ecosystem":"Packagist","package":"sylius/sylius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.1.18"}]}],"versions":["v1.0.0","v1.0.1","v1.0.10","v1.0.11","v1.0.12","v1.0.13","v1.0.14","v1.0.15","v1.0.16","v1.0.17","v1.0.18","v1.0.2","v1.0.3","v1.0.4","v1.0.5","v1.0.6","v1.0.7","v1.0.8","v1.0.9","v1.1.0","v1.1.0-RC","v1.1.1","v1.1.10","v1.1.11","v1.1.12","v1.1.13","v1.1.14","v1.1.15","v1.1.16","v1.1.17","v1.1.2","v1.1.3","v1.1.4","v1.1.5","v1.1.6","v1.1.7","v1.1.8","v1.1.9"]},{"source":"osv","ecosystem":"Packagist","package":"sylius/sylius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.0"},{"fixed":"1.2.17"}]}],"versions":["v1.2.0","v1.2.1","v1.2.10","v1.2.11","v1.2.12","v1.2.13","v1.2.14","v1.2.15","v1.2.16","v1.2.2","v1.2.3","v1.2.4","v1.2.5","v1.2.6","v1.2.7","v1.2.8","v1.2.9"]},{"source":"osv","ecosystem":"Packagist","package":"sylius/sylius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.0"},{"fixed":"1.3.12"}]}],"versions":["v1.3.0","v1.3.1","v1.3.10","v1.3.11","v1.3.2","v1.3.3","v1.3.4","v1.3.5","v1.3.6","v1.3.7","v1.3.8","v1.3.9"]},{"source":"osv","ecosystem":"Packagist","package":"sylius/sylius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.4.0"},{"fixed":"1.4.4"}]}],"versions":["v1.4.0","v1.4.1","v1.4.2","v1.4.3"]}],"products":[{"vendor":"sylius","product":"grid"},{"vendor":"sylius","product":"sylius"}],"references":[{"url":"https://sylius.com/blog/cve-2019-12186/","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-12186","tags":["advisory"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/sylius/grid/CVE-2019-12186.yaml","tags":["web"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/sylius/sylius/CVE-2019-12186.yaml","tags":["web"]},{"url":"https://sylius.com/blog/cve-2019-12186","tags":["web"]},{"url":"https://github.com/advisories/GHSA-rc5r-697f-28x6"}],"sources":{"cve":[{"id":"CVE-2019-12186","description":"An issue was discovered in Sylius products. Missing input sanitization in sylius/sylius 1.0.x through 1.0.18, 1.1.x through 1.1.17, 1.2.x through 1.2.16, 1.3.x through 1.3.11, and 1.4.x through 1.4.3 and sylius/grid 1.0.x through 1.0.18, 1.1.x through 1.1.18, 1.2.x through 1.2.17, 1.3.x through 1.3.12, 1.4.x through 1.4.4, and 1.5.0 allows an attacker (an admin in the sylius/sylius case) to perform XSS by injecting malicious code into a field displayed in a grid with the \"string\" field type. The contents are an object, with malicious code returned by the __toString() method of that object.","status":"published","published":"2019-12-31T14:21:39Z","modified":"2024-08-04T23:10:30.817Z","updated_at":"2026-11-02T14:20:23.697579Z"}],"euvd":[{"id":"EUVD-2020-0393","description":"An issue was discovered in Sylius products. Missing input sanitization in sylius/sylius 1.0.x through 1.0.18, 1.1.x through 1.1.17, 1.2.x through 1.2.16, 1.3.x through 1.3.11, and 1.4.x through 1.4.3 and sylius/grid 1.0.x through 1.0.18, 1.1.x through 1.1.18, 1.2.x through 1.2.17, 1.3.x through 1.3.12, 1.4.x through 1.4.4, and 1.5.0 allows an attacker (an admin in the sylius/sylius case) to perform XSS by injecting malicious code into a field displayed in a grid with the \"string\" field type. The contents are an object, with malicious code returned by the __toString() method of that object.","status":"published","published":"2019-12-31T14:21:39Z","modified":"2024-08-04T23:10:30Z","updated_at":"2026-11-03T02:40:46.843701Z"}],"ghsa":[{"id":"GHSA-rc5r-697f-28x6","title":"XSS injection in the Grid component of Sylius","description":"Grid component of Sylius omits HTML input sanitisation while rendering object implementing __toString() method through the string field type.","status":"published","published":"2020-04-15T21:07:59Z","modified":"2024-02-26T12:35:42Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:37:38.935144Z"}],"nvd":[{"id":"CVE-2019-12186","description":"An issue was discovered in Sylius products. Missing input sanitization in sylius/sylius 1.0.x through 1.0.18, 1.1.x through 1.1.17, 1.2.x through 1.2.16, 1.3.x through 1.3.11, and 1.4.x through 1.4.3 and sylius/grid 1.0.x through 1.0.18, 1.1.x through 1.1.18, 1.2.x through 1.2.17, 1.3.x through 1.3.12, 1.4.x through 1.4.4, and 1.5.0 allows an attacker (an admin in the sylius/sylius case) to perform XSS by injecting malicious code into a field displayed in a grid with the \"string\" field type. The contents are an object, with malicious code returned by the __toString() method of that object.","status":"published","published":"2019-12-31T15:15:10.957Z","modified":"2026-06-17T02:14:13.15Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":3.5,"vector":"AV:N/AC:M/Au:S/C:N/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:05:41.313583Z"}],"osv":[{"id":"CVE-2019-12186","description":"An issue was discovered in Sylius products. Missing input sanitization in sylius/sylius 1.0.x through 1.0.18, 1.1.x through 1.1.17, 1.2.x through 1.2.16, 1.3.x through 1.3.11, and 1.4.x through 1.4.3 and sylius/grid 1.0.x through 1.0.18, 1.1.x through 1.1.18, 1.2.x through 1.2.17, 1.3.x through 1.3.12, 1.4.x through 1.4.4, and 1.5.0 allows an attacker (an admin in the sylius/sylius case) to perform XSS by injecting malicious code into a field displayed in a grid with the \"string\" field type. The contents are an object, with malicious code returned by the __toString() method of that object.","status":"published","published":"2019-12-31T15:15:10.957Z","modified":"2026-10-24T10:30:44.23171011Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:10.718934Z"},{"id":"GHSA-rc5r-697f-28x6","title":"XSS injection in the Grid component of Sylius","description":"Grid component of Sylius omits HTML input sanitisation while rendering object implementing __toString() method through the string field type.","status":"published","published":"2020-04-15T21:07:59Z","modified":"2026-09-10T03:48:43.977470331Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:55.877614Z"}]}}