AIKIDO-2026-11074

TL;DR

Symfony UX LiveComponent's ChildComponentPartialRenderer::createHtml() interpolates the $childTag value directly into HTML without escaping or validation. The value comes from the client-supplied children[id].tag field handled by LiveComponentSubscriber and InterceptChildComponentRenderSubscriber, so an attacker who can reach the Live Component endpoint can inject arbitrary HTML, including <script> tags, on any re-render of a component that has a child component. The endpoint is normally protected by an Accept: application/vnd.live-component+html header check, but that gate can be bypassed via relaxed CORS or a same-origin XSS pivot. The fix validates $childTag against a strict HTML tag-name regex and rejects non-matching values.