Medium severity · published Mar 10, 2026
CVE-2026-31822
Sylius has a XSS vulnerability in checkout login form
6.1
CVSS
0.2%
EPSS
No
On KEV
Description
Sylius is an Open Source eCommerce Framework on Symfony. A cross-site scripting (XSS) vulnerability exists in the shop checkout login form handled by the ApiLoginController Stimulus controller. When a login attempt fails, AuthenticationFailureHandler returns a JSON response whose message field is rendered into the DOM using innerHTML, allowing any HTML or JavaScript in that value to be parsed and executed by the browser. The issue is fixed in versions: 2.0.16, 2.1.12, 2.2.3 and above.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 9% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SY
Sylius · Sylius
>= 2.2.0, < 2.2.3; >= 2.1.0, < 2.1.12; >= 2.0.0, < 2.0.16 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-31822
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-31822
Mitigation
https://github.com/Sylius/Sylius/security/advisories/GHSA-vgh8-c6fp-7gcg
More from Sylius
8.8
CVE-2026-100871
Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 JWT Audience Confusion Allows Admin API Authentication
8.8
CVE-2026-100870
Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 Admin Password Reset Poisoning via Host Header
8.2
CVE-2022-24743
Sylius is an open source eCommerce platform
7.5
CVE-2026-100872
Sylius 2.x before 2.1.16 and 2.2.9 Payment Amount Overwrite
7.5
CVE-2024-57610
A rate limiting issue in Sylius v2.0.2 allows a remote attacker to perform unrestricted brute-force attacks on user accounts, significantly increasing the risk of account…