Blade `@parent` Exploitation Leading To Possible XSS in Laravel
Priority LOW 29CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting, Information disclosure
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79 and CWE-327.
Summary
Laravel is a web application framework. Laravel prior to versions 8.75.0, 7.30.6, and 6.20.42 contain a possible cross-site scripting (XSS) vulnerability in the Blade templating engine. A broken HTML element may be clicked and the user taken to another location in their browser due to XSS. This is due to the user being able to guess the parent placeholder SHA-1 hash by trying common names of sections. If the parent template contains an exploitable HTML structure an XSS vulnerability can be exposed. This vulnerability has been patched in versions 8.75.0, 7.30.6, and 6.20.42 by determining the parent placeholder at runtime and using a random hash that is unique to each request.
Why it matters now
EPSS 0.00825 57th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed framework (laravel): 8.75.0, 7.30.6, 6.20.42laravel/framework (Packagist): 6.20.42, 7.30.6, 8.75.0+1 more product
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Laravel | framework | 8.0.0 to before 8.75.0; 7.0.0 to before 7.30.6; before 6.20.42 | 8.75.0, 7.30.6, 6.20.42 | Patch available | CNA |
| — | laravel/framework (Packagist) | before 6.20.42 | 6.20.42 | Patch available | GHSA-66hf-2p6w-jqfw |
| — | laravel/framework (Packagist) | 7.0.0 to before 7.30.6 | 7.30.6 | Patch available | GHSA-66hf-2p6w-jqfw |
| — | laravel/framework (Packagist) | 8.0.0 to before 8.75.0 | 8.75.0 | Patch available | GHSA-66hf-2p6w-jqfw |
| — | illuminate/view (Packagist) | before 6.20.42 | 6.20.42 | Patch available | GHSA-66hf-2p6w-jqfw |
| — | illuminate/view (Packagist) | 7.0.0 to before 7.30.6 | 7.30.6 | Patch available | GHSA-66hf-2p6w-jqfw |
| — | illuminate/view (Packagist) | 8.0.0 to before 8.75.0 | 8.75.0 | Patch available | GHSA-66hf-2p6w-jqfw |
- framework VendorLaravel Affected 8.0.0 to before 8.75.0; 7.0.0 to before 7.30.6; before 6.20.42 Fixed in 8.75.0, 7.30.6, 6.20.42 Patch available CNA
- laravel/framework (Packagist) Vendor— Affected before 6.20.42 Fixed in 6.20.42 Patch available GHSA-66hf-2p6w-jqfw
- laravel/framework (Packagist) Vendor— Affected 7.0.0 to before 7.30.6 Fixed in 7.30.6 Patch available GHSA-66hf-2p6w-jqfw
- laravel/framework (Packagist) Vendor— Affected 8.0.0 to before 8.75.0 Fixed in 8.75.0 Patch available GHSA-66hf-2p6w-jqfw
- illuminate/view (Packagist) Vendor— Affected before 6.20.42 Fixed in 6.20.42 Patch available GHSA-66hf-2p6w-jqfw
- illuminate/view (Packagist) Vendor— Affected 7.0.0 to before 7.30.6 Fixed in 7.30.6 Patch available GHSA-66hf-2p6w-jqfw
- illuminate/view (Packagist) Vendor— Affected 8.0.0 to before 8.75.0 Fixed in 8.75.0 Patch available GHSA-66hf-2p6w-jqfw
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:laravel:framework:*:*:*:*:*:*:*:* | before 6.20.42; 7.0.0 to before 7.30.6; 8.0.0 to before 8.75.0 | Vulnerable | Laravel |
- cpe:2.3:a:laravel:framework:*:*:*:*:*:*:*:* Versions before 6.20.42; 7.0.0 to before 7.30.6; 8.0.0 to before 8.75.0 Vulnerable ·Laravel
Remediation
- Fix · CNA framework (laravel) Fixed in 8.75.0, 7.30.6, 6.20.42
- Fix · GHSA-66hf-2p6w-jqfw laravel/framework (Packagist) Fixed in 6.20.42 Advisory →
- Fix · GHSA-66hf-2p6w-jqfw laravel/framework (Packagist) Fixed in 7.30.6 Advisory →
- Fix · GHSA-66hf-2p6w-jqfw laravel/framework (Packagist) Fixed in 8.75.0 Advisory →
- Fix · GHSA-66hf-2p6w-jqfw illuminate/view (Packagist) Fixed in 6.20.42 Advisory →
- Fix · GHSA-66hf-2p6w-jqfw illuminate/view (Packagist) Fixed in 7.30.6 Advisory →
- Fix · GHSA-66hf-2p6w-jqfw illuminate/view (Packagist) Fixed in 8.75.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2021-43808
- 2026-10-03 Alias added: GHSA-66hf-2p6w-jqfw
References
Patch 4
Advisory 4
More Laravel Framework vulnerabilities
- TI-2024-34976 Laravel allows environment manipulation via query string CVSS 4.0HIGH 8.7
- TI-2024-12938 Laravel Reflected XSS via Route Parameter in Debug-Mode Error Page CVSS 3.1HIGH 8.0
- TI-2024-12937 Laravel Reflected XSS via Request Parameter in Debug-Mode Error Page CVSS 3.1HIGH 8.0
- TI-2022-19208 The authentication method in Laravel 8.x through 9.x before 9.32.0 was discovered to be… CVSS 3.1MEDIUM 5.3
- TI-2021-19485 Laravel Framework through 8.70.2 does not sufficiently block the upload of executable PHP… CVSS 3.1CRITICAL 9.8
- TI-2020-13600 OS Command injection vulnerability in function link in Filesystem.php in Laravel Framework before 5.8.17. CVSS 3.1HIGH 8.8
Sources
- CVE-2021-43808 · CVE Program
- CVE-2021-43808 · NVD
- FIRST EPSS
- GHSA-66hf-2p6w-jqfw · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences