AIKIDO-2026-11055

TL;DR

The Symfony UX Autocomplete Stimulus controller renders the text field from AJAX endpoint responses directly into the dropdown using template literals in _createAutocompleteWithRemoteData(), without HTML escaping. Any attacker-influenced data that reaches an entity rendered by the autocomplete can inject HTML and JavaScript that executes in the browser of users viewing the field. The fix routes the value through TomSelect's escape() helper by default and introduces an explicit options_as_html opt-in for endpoints that legitimately return HTML.