Impact The POST /api/v2/shop/orders/{tokenValue}/items endpoint does not verify cart ownership. An unauthenticated attacker can add items to other registered customers' carts by knowing the cart tokenValue.

POST /api/v2/shop/orders/{tokenValue}/items

Other mutation endpoints (PUT, PATCH, DELETE) are not affected. API Platform loads the Order entity through the state provider for these operations, which triggers VisitorBasedExtension and returns 404 for unauthorized users.

An attacker who obtains a cart tokenValue can add arbitrary items to another customer's cart. The endpoint returns the full cart representation in the response (HTTP 201), potentially leaking:

- Customer email address - Cart contents (products, quantities, prices) - Address data (billing and shipping if set) - Payment and shipment IDs - Order totals and tax breakdown - Checkout state

Patches The issue is fixed in versions: 2.0.16, 2.1.12, 2.2.3, and above.

Workarounds Add an ownership check in AddItemToCartHandler by injecting UserContextInterface and verifying the current user matches the cart owner before adding items.

Step 1. Patch the handler

Create new src/CommandHandler/Cart/AddItemToCartHandler.php:

php <?php

declare(stricttypes=1);

namespace App\CommandHandler\Cart;

use Sylius\Bundle\ApiBundle\Command\Cart\AddItemToCart; use Sylius\Bundle\ApiBundle\Context\UserContextInterface; use Sylius\Component\Core\Factory\CartItemFactoryInterface; use Sylius\Component\Core\Model\OrderInterface; use Sylius\Component\Core\Model\OrderItemInterface; use Sylius\Component\Core\Model\ProductVariantInterface; use Sylius\Component\Core\Model\ShopUserInterface; use Sylius\Component\Core\Repository\OrderRepositoryInterface; use Sylius\Component\Core\Repository\ProductVariantRepositoryInterface; use Sylius\Component\Order\Modifier\OrderItemQuantityModifierInterface; use Sylius\Component\Order\Modifier\OrderModifierInterface; use Symfony\Component\HttpKernel\Exception\NotFoundHttpException; use Symfony\Component\Messenger\Attribute\AsMessageHandler;

#[AsMessageHandler] final readonly class AddItemToCartHandler { public function construct( private OrderRepositoryInterface $orderRepository, private ProductVariantRepositoryInterface $productVariantRepository, private OrderModifierInterface $orderModifier, private CartItemFactoryInterface $cartItemFactory, private OrderItemQuantityModifierInterface $orderItemQuantityModifier, private UserContextInterface $userContext, ) { }

public function invoke(AddItemToCart $addItemToCart): OrderInterface { / @var ProductVariantInterface|null $productVariant / $productVariant = $this->productVariantRepository->findOneBy(['code' => $addItemToCart->productVariantCode]);

if ($productVariant === null) { throw new \InvalidArgumentException('Product variant with given code has not been found.'); }

/ @var OrderInterface|null $cart / $cart = $this->orderRepository->findCartByTokenValue($addItemToCart->orderTokenValue);

if ($cart === null) { throw new \InvalidArgumentException('Cart with given token has not been found.'); }

$this->assertCartAccessible($cart);

/ @var OrderItemInterface $cartItem / $cartItem = $this->cartItemFactory->createNew(); $cartItem->setVariant($productVariant);

$this->orderItemQuantityModifier->modify($cartItem, $addItemToCart->quantity); $this->orderModifier->addToOrder($cart, $cartItem);

return $cart; }

private function assertCartAccessible(OrderInterface $cart): void { if ($cart->isCreatedByGuest()) { return; }

$cartCustomer = $cart->getCustomer();

if (null === $cartCustomer || null === $cartCustomer->getUser()) { return; }

$currentUser = $this->userContext->getUser();

if ( $currentUser instanceof ShopUserInterface && $currentUser->getCustomer()?->getId() === $cartCustomer->getId() ) { return; }

throw new NotFoundHttpException('Cart not found.'); } }

Step 2. Override the service

diff config/services.yaml

services: App\: resource: '../src/' - exclude: '../src/{Entity,Kernel.php}' + exclude: '../src/{Entity,Kernel.php,CommandHandler}'

syliusapi.commandhandler.cart.additemtocart: class: App\CommandHandler\Cart\AddItemToCartHandler arguments: $orderRepository: '@sylius.repository.order' $productVariantRepository: '@sylius.repository.productvariant' $orderModifier: '@sylius.modifier.order' $cartItemFactory: '@sylius.factory.orderitem' $orderItemQuantityModifier: '@sylius.modifier.orderitemquantity' $userContext: '@Sylius\Bundle\ApiBundle\Context\UserContextInterface' tags: - { name: messenger.messagehandler, bus: sylius.commandbus }

Step 3. Clear cache

bash bin/console cache:clear

Reporters

We would like to extend our gratitude to the following individuals for their detailed reporting and responsible disclosure of this vulnerability: - @rokorolov

For more information If you have any questions or comments about this advisory:

- Open an issue in Sylius issues - Email us at security@sylius.com

Impact

A cross-site scripting (XSS) vulnerability exists in the shop checkout login form handled by the ApiLoginController Stimulus controller.

When a login attempt fails, AuthenticationFailureHandler returns a JSON response whose message field is rendered into the DOM using innerHTML, allowing any HTML or JavaScript in that value to be parsed and executed by the browser.

The message value originates from AuthenticationException::getMessageKey() passed through Symfony's translator (security domain, using the request locale). In the default Sylius installation, this returns a hardcoded translation key (e.g. "Invalid credentials."), which is not directly user-controlled. However, using innerHTML with server-derived data violates defense-in-depth principles, and the risk escalates significantly under realistic scenarios: - Customized authentication handlers — if a project overrides AuthenticationFailureHandler to include user-supplied data in the message (e.g. "No account found for <username>"), an attacker can inject arbitrary JavaScript directly via the login form without any privileged access. - Translation injection — if translation files are sourced from an untrusted database or CMS and contain HTML, the message could carry a malicious payload. - Man-in-the-Middle — if the response is intercepted (e.g. on HTTP or via a compromised proxy), an attacker can inject arbitrary HTML/JS into the message field. - Server-side injection — if any middleware, reverse proxy, or error handler modifies the JSON response body, malicious content could be injected into the message field.

Exploitation could lead to session hijacking, credential theft, cart/order manipulation, or phishing within the trusted shop domain.

The vulnerability affects all Sylius installations that use the default shop checkout login form with the bundled ApiLoginController.js.

Patches The issue is fixed in versions: 2.0.16, 2.1.12, 2.2.3 and above.

Workarounds Override the vulnerable JavaScript controller at the project level. Note: Step 2 differs between Sylius 2.0 and up

Step 1. Override JavaScript controller handling login Patch ApiLoginController.js

Copy the original from vendor/sylius/sylius/src/Sylius/Bundle/ShopBundle/Resources/assets/controllers/ApiLoginController.js to assets/shop/controllers/ApiLoginController.js and apply: diff ... .then(response => { if (response.success) { window.location.reload(); } else { const errorElement = this.errorPrototypeTarget.cloneNode(true); - errorElement.innerHtml = response.message; + errorElement.textContent = response.message; this.errorTarget.innerHTML = errorElement.outerHTML; } }) ...

Step 2. Register the patched controller Sylius 2.1+ (Stimulus Bridge with controllers.json)

Disable the vendor controller in assets/shop/controllers.json: diff ... "api-login": { - "enabled": true, + "enabled": false, "fetch": "lazy" } ... Register the overwritten controller in assets/shop/bootstrap.js js import ApiLoginController from './controllers/ApiLoginController'

app.register('sylius--shop-bundle--api-login', ApiLoginController); --- Sylius 2.0 (explicit imports in vendor app.js)

Use Webpack's NormalModuleReplacementPlugin to swap the controller at build time. In webpack.config.js, after shopConfig is created:

diff + const webpack = require('webpack'); ... // Shop config const shopConfig = SyliusShop.getWebpackConfig(path.resolve(dirname)); + shopConfig.plugins.push( + new webpack.NormalModuleReplacementPlugin( + /\/controllers\/ApiLoginController\.js$/, + path.resolve(dirname, 'assets/shop/controllers/ApiLoginController.js') + ) + ); ...

Step 3. Rebuild assets

bash yarn encore dev # or: yarn encore production

Reporters

We would like to extend our gratitude to the following individuals for their detailed reporting and responsible disclosure of this vulnerability: - Bartłomiej Nowiński (@bnBart)

For more information

If you have any questions or comments about this advisory:

- Open an issue in Sylius issues - Email us at security@sylius.com

Impact Sylius API filters ProductPriceOrderFilter and TranslationOrderNameAndLocaleFilter pass user-supplied order direction values directly to Doctrine's orderBy() without validation. An attacker can inject arbitrary DQL:

GET /api/v2/shop/products?order[price]=ASC,%20variant.code%20DESC

Patches The issue is fixed in versions: 1.9.12, 1.10.16, 1.11.17, 1.12.23, 1.13.15, 1.14.18, 2.0.16, 2.1.12, 2.2.3 and above.

Workarounds

An EventSubscriber that sanitizes order query parameters only on API routes before they reach the vulnerable filters.

The subscriber accepts an $apiRoute constructor parameter (default /api/v2) and skips non-API requests entirely — so there is zero overhead on shop/admin page requests.

This follows the same pattern used by Sylius's own KernelRequestEventSubscriber (src/Sylius/Bundle/ApiBundle/EventSubscriber/KernelRequestEventSubscriber.php), which also uses strcontains($pathInfo, $this->apiRoute) to scope logic to API routes.

---

Step 1 — Create the EventSubscriber

src/EventSubscriber/SanitizeOrderDirectionSubscriber.php:

php <?php

declare(stricttypes=1);

namespace App\EventSubscriber;

use Symfony\Component\EventDispatcher\EventSubscriberInterface; use Symfony\Component\HttpKernel\Event\RequestEvent; use Symfony\Component\HttpKernel\KernelEvents;

final class SanitizeOrderDirectionSubscriber implements EventSubscriberInterface { private const ALLOWEDDIRECTIONS = ['asc', 'desc'];

public function construct( private string $apiRoute, ) { }

public static function getSubscribedEvents(): array { return [ KernelEvents::REQUEST => ['sanitizeOrderParameters', 64], ]; }

public function sanitizeOrderParameters(RequestEvent $event): void { if (!strcontains($event->getRequest()->getPathInfo(), $this->apiRoute)) { return; }

$request = $event->getRequest();

/ @var mixed $order / $order = $request->query->all()['order'] ?? null; if (!isarray($order)) { return; }

$needsSanitization = false; $sanitized = []; foreach ($order as $field => $direction) { if (isstring($direction) && inarray(strtolower($direction), self::ALLOWEDDIRECTIONS, true)) { $sanitized[$field] = $direction; } else { $needsSanitization = true; } }

if (!$needsSanitization) { return; }

$all = $request->query->all(); $all['order'] = $sanitized; $request->query->replace($all);

$request->server->set('QUERYSTRING', httpbuildquery($all)); $request->attributes->set('apifilters', $all); } }

Step 2 — Register the service

Option A — If your config/services.yaml already has App\ autowiring (Symfony default):

yaml Nothing to do — autoconfigure picks up EventSubscriberInterface automatically. Optionally bind the API route prefix: services: App\EventSubscriber\SanitizeOrderDirectionSubscriber: arguments: $apiRoute: '%sylius.security.newapiroute%'

Option B — If there is no App\ autowiring:

yaml services: App\EventSubscriber\SanitizeOrderDirectionSubscriber: arguments: $apiRoute: '%sylius.security.newapiroute%' tags: ['kernel.eventsubscriber']

Using %sylius.security.newapiroute% ties the subscriber to the same prefix Sylius uses (/api/v2 by default). If the parameter is not available, hardcode '/api/v2' instead.

Step 3 — Clear cache

bash bin/console cache:clear

Reporters

We would like to extend our gratitude to the following individuals for their detailed reporting and responsible disclosure of this vulnerability: - Chris Alupului (@Neosprings) - Bartłomiej Nowiński (@bnBart)

For more information If you have any questions or comments about this advisory:

- Open an issue in Sylius issues - Email us at security@sylius.com

Impact

An authenticated stored cross-site scripting (XSS) vulnerability exists in multiple places across the shop frontend and admin panel due to unsanitized entity names being rendered as raw HTML.

Shop breadcrumbs (shared/breadcrumbs.html.twig): The breadcrumbs macro uses the Twig |raw filter on label values. Since taxon names, product names, and ancestor names flow directly into these labels, a malicious taxon name like <img src=x onerror=alert('XSS')> is rendered and executed as JavaScript on the storefront.

Admin product taxon picker (ProductTaxonTreeController.js): The rowRenderer method interpolates ${name} directly into a template literal building HTML, allowing script injection through taxon names in the admin panel.

Admin autocomplete fields (Tom Select): Dropdown items and options render entity names as raw HTML without escaping, allowing XSS through any autocomplete field displaying entity names.

An authenticated administrator can inject arbitrary HTML or JavaScript via entity names (e.g. taxon name) that is persistently rendered for all users.

Patches

The issue is fixed in versions: 2.0.16, 2.1.12, 2.2.3 and above.

Workarounds

Override vulnerable templates and JavaScript controllers at the project level.

---

Step 1 — Override shop breadcrumbs template

templates/bundles/SyliusShopBundle/shared/breadcrumbs.html.twig:

twig {% macro breadcrumbs(items) %} <ol class="breadcrumb" aria-label="breadcrumbs"> {% for item in items %} <li class="breadcrumb-item fw-normal{{ item.active is defined and item.active ? ' active' }}"> {% if item.path is defined %} <a class="link-reset" href="{{ item.path }}" {{ item.testattribute is defined ? syliustesthtmlattribute(item.testattribute) }}>{{ item.label }}</a> {% else %} <span class="text-body-tertiary text-break" {{ item.testattribute is defined ? syliustesthtmlattribute(item.testattribute) }}>{{ item.label }}</span> {% endif %} </li> {% endfor %} </ol> {% endmacro %}

Step 2 — Override order breadcrumbs template

templates/bundles/SyliusShopBundle/account/order/show/content/breadcrumbs.html.twig:

twig {% from '@SyliusShop/shared/breadcrumbs.html.twig' import breadcrumbs as breadcrumbs %}

{% set order = hookablemetadata.context.order %}

<div class="col-12"> {{ breadcrumbs([ { label: 'sylius.ui.home'|trans, path: path('syliusshophomepage')}, { label: 'sylius.ui.myaccount'|trans, path: path('syliusshopaccountdashboard')}, { label: 'sylius.ui.orderhistory'|trans, path: path('syliusshopaccountorderindex')}, { label: '#'~order.number, active: true, testattribute: 'order-number' } ]) }} </div>

Step 3 — Override ProductTaxonTreeController.js

Disable the vendor controller in assets/admin/controllers.json:

diff "product-taxon-tree": { - "enabled": true, + "enabled": false, "fetch": "lazy" },

Create assets/admin/controllers/producttaxontreecontroller.js — copy the original from vendor/sylius/sylius/src/Sylius/Bundle/AdminBundle/Resources/assets/controllers/ProductTaxonTreeController.js and apply the following change:

diff + const escapeHtml = (str) => { + const div = document.createElement('div'); + div.textContent = str; + return div.innerHTML; + };

// in rowRenderer: - <span class="infinite-tree-title">${name}</span> + <span class="infinite-tree-title">${escapeHtml(name)}</span>

Register the patched controller in assets/admin/bootstrap.js:

js import ProductTaxonTreeController from './controllers/producttaxontreecontroller'; app.register('sylius--admin-bundle--product-taxon-tree', ProductTaxonTreeController);

Step 4 — Add autocomplete XSS protection

assets/admin/scripts/autocomplete-xss-protection.js:

js const escapeHtml = (str) => { if (typeof str !== 'string') return str; const div = document.createElement('div'); div.textContent = str; return div.innerHTML; };

document.addEventListener('autocomplete:pre-connect', (event) => { const options = event.detail.options; if (!options.render) return;

const labelField = options.labelField || 'text'; const wrapRenderer = (renderer) => { if (!renderer) return renderer; return (data, escape) => { const escaped = { ...data }; if (escaped[labelField]) { escaped[labelField] = escapeHtml(escaped[labelField]); } return renderer(escaped, escape); }; };

if (options.render.item) options.render.item = wrapRenderer(options.render.item); if (options.render.option) options.render.option = wrapRenderer(options.render.option); });

Import in assets/admin/entrypoint.js before bootstrap:

diff + import './scripts/autocomplete-xss-protection'; import './bootstrap.js';

Step 5 — Rebuild assets

bash yarn encore dev # or: yarn encore production

Reporters

We would like to extend our gratitude to the following individuals for their detailed reporting and responsible disclosure of this vulnerability: - Djibril Mounkoro (@whiteov3rflow) - Bartłomiej Nowiński (@bnBart)

For more information

If you have any questions or comments about this advisory:

- Open an issue in Sylius issues - Email us at security@sylius.com