[MEDIUM] symfony/ux-live-component XSS via attacker-controlled child component tag

PKSA-87hx-5gp4-x12b CVE-2026-49210 GHSA-38x5-rcv4-xf7x

Affected package: symfony/ux-live-component

Affected version: >=2.8.0,<2.36.0|>=3.0.0,<3.1.0

Reported by:
GitHub, FriendsOfPHP/security-advisories