CVE-2026-49208Medium▾ Sunlitux-live-component: Format-less date LiveProps parsed with the permissive DateTime constructor
▾ Sunlit zone — Low / medium · no exploitation signal
impact 27.5 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 18.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
0.3%
0.3% → 0.4%
When a #[LiveProp] is typed as a DateTimeInterface and no explicit format is configured, Symfony\UX\LiveComponent\LiveComponentHydrator::hydrateObjectValue() falls back to new $className($value). The DateTime / DateTimeImmutable constructors accept relative strings such as "now", "tomorrow", or "+10 years", so a writable, format-less date prop can be pushed to an arbitrary point in time by the client. Components that rely on a date prop to gate time-based business logic can be moved past those checks by a frontend payload that no maintainer would consider a valid date.
hydrateObjectValue() now parses format-less date props strictly with createFromFormat(DateTimeInterface::RFC3339, ...), matching the format already emitted by dehydrateObjectValue(). Normal round-trips are unaffected; only inputs that aren't valid RFC 3339 are now rejected, which is consistent with how a format-configured prop already behaved.
The patch for this issue is available here for branch 2.x (and forward-ported to 3.x).
Symfony would like to thank Pascal Cescon for reporting the issue and Hugo Alliaume for providing the fix.
symfony/ux-live-component >= 2.8.0, < 2.36.0symfony/ux-live-component >= 3.0.0, < 3.1.0Upgrade to a patched release:
symfony/ux-live-component 2.36.0symfony/ux-live-component 3.1.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-47767MediumSymfonyRuntime CVE-2024-50340 Patch Bypass: Web Requests Can Still Set APP_ENV/APP_DEBUG via parse_str/SAPI Argv Mismatch
CVE-2026-49209Lowsymfony/ux-live-component: Denial of service via unbounded batch action requests
CVE-2026-49210Mediumsymfony/ux-live-component: XSS via attacker-controlled child component tag
CVE-2026-49212Lowsymfony/ux-live-component: LiveComponentHydrator HMAC checksum lacks component and slot binding
CVE-2026-49215Lowsymfony/ux-live-component: CSRF Protection Bypass — Accept Header is CORS-Safelisted
CVE-2021-45105Medium· 5.9Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups