CVE-2019-12186

Description

Grid component of Sylius omits HTML input sanitisation while rendering object implementing __toString() method through the string field type.

Affected packages (3)

• Packagist/sylius/grid>= 1.0.0, < 1.1.19
• Packagist/sylius/grid-bundle>= 1.0.0, < 1.1.19
• Packagist/sylius/sylius>= 1.0.0, < 1.1.18

CVSS scores

References (4)

• ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2019-12186
• WEBhttps://github.com/FriendsOfPHP/security-advisories/blob/master/sylius/grid/CVE-2019-12186.yaml
• WEBhttps://github.com/FriendsOfPHP/security-advisories/blob/master/sylius/sylius/CVE-2019-12186.yaml
• WEBhttps://sylius.com/blog/cve-2019-12186