[MEDIUM] symfony/ux-autocomplete XSS via unescaped AJAX response data

PKSA-q7f1-2s55-5c1z CVE-2026-49216 GHSA-mwqm-4fw3-cjvr

Affected package: symfony/ux-autocomplete

Affected version: >=2.2.0,<2.36.0|>=3.0.0,<3.1.0

Reported by:
GitHub, FriendsOfPHP/security-advisories