CVE-2023-41336

ux-autocomplete is a JavaScript Autocomplete functionality for Symfony. Under certain circumstances, an attacker could successfully submit an entity id for an `EntityType` that is *not* part of the valid choices. The problem has been fixed in `symfony/ux-autocomplete` version 2.11.2.

• CWE-20

• https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/ux-autocomplete/CVE-2023-41336.yamlThird Party Advisory
• https://github.com/symfony/ux-autocomplete/commit/fabcb2eee14b9e84a45b276711853a560b5d770cPatch
• https://github.com/symfony/ux-autocomplete/security/advisories/GHSA-4cpv-669c-r79xVendor Advisory
• https://symfony.com/bundles/ux-autocomplete/current/index.html#usage-in-a-form-with-ajaxProduct
• https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/ux-autocomplete/CVE-2023-41336.yamlThird Party Advisory
• https://github.com/symfony/ux-autocomplete/commit/fabcb2eee14b9e84a45b276711853a560b5d770cPatch
• https://github.com/symfony/ux-autocomplete/security/advisories/GHSA-4cpv-669c-r79xVendor Advisory
• https://symfony.com/bundles/ux-autocomplete/current/index.html#usage-in-a-form-with-ajaxProduct

Published

Sep 11, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-41330knplabs/knp-snappy is a PHP library allowing thumbnail, snap…9.8
• CVE-2023-41331SOFARPC is a Java RPC framework. Versions prior to 5.11.0 ar…9.8
• CVE-2023-41332Cilium is a networking, observability, and security solution…3.5
• CVE-2023-41333Cilium is a networking, observability, and security solution…8.1
• CVE-2023-41334Astropy is a project for astronomy in Python that fosters in…8.4
• CVE-2023-41335Synapse is an open-source Matrix homeserver written and main…3.7
• CVE-2023-41337h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and …6.7
• CVE-2023-41338Fiber is an Express inspired web framework built in the go l…5.3
• CVE-2023-41339GeoServer is an open source software server written in Java …5.3
• CVE-2023-4134A use-after-free vulnerability was found in the cyttsp4_core…5.5
• CVE-2023-41343Rogic No-Code Database Builder's file uploading function has…5.4
• CVE-2023-41344NCSIST ManageEngine Mobile Device Manager(MDM) APP's special…7.5