Detections
Analytics

SCA: security update for sylius/sylius (GHSA-9ffx-f77r-756w)

medium Tenable Self-Hosted Container Security Plugin ID 438663

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Sylius is an Open Source eCommerce Framework on Symfony. CurrencySwitchController::switchAction(),
 ImpersonateUserController::impersonateAction() and StorageBasedLocaleSwitcher::handle() use the HTTP
 Referer header directly when redirecting. The attack requires the victim to click a legitimate application
 link placed on an attacker-controlled page. The browser automatically sends the attacker's site as the
 Referer, and the application redirects back to it. This can be used for phishing or credential theft, as
 the redirect originates from a trusted domain. The severity varies by endpoint; public endpoints require
 no authentication and are trivially exploitable, while admin-only endpoints require an authenticated
 session but remain vulnerable if an admin follows a link from an external source such as email or chat.
 The issue is fixed in versions: 1.9.12, 1.10.16, 1.11.17, 1.12.23, 1.13.15, 1.14.18, 2.0.16, 2.1.12, 2.2.3
 and above. (CVE-2026-31819)

Solution

Update the sylius/sylius library and its related packages to version 1.10.16 or later.

See Also

https://github.com/advisories/GHSA-9ffx-f77r-756w

Plugin Details

Severity: Medium

ID: 438663

Version: Revision 1.5

Type: Local

Family: SCA Checks

Published: 3/12/2026

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 2.3

Percentile: 9.42

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 6.4

Temporal Score: 4.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N

CVSS Score Source: CVE-2026-31819

CVSS v3

Risk Factor: Medium

Base Score: 6.1

Temporal Score: 5.3

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: Medium

Base Score: 6.9

Threat Score: 2.7

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 3/11/2026

Vulnerability Publication Date: 3/10/2026

Reference Information

CVE: CVE-2026-31819

cwe: CWE-601