Laravel: XSS in Debug Page Information
Priority LOW 15CWE-80Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- High
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-80.
Summary
Laravel is a web application framework. Prior to 12.69.0 and 13.30.0, Laravel exception debug pages with APP_DEBUG=true pass attacker-controlled input to a Tippy.js tooltip configured with allowHTML true, enabling DOM-based cross-site scripting when a user hovers over the tooltip. This issue is fixed in versions 12.69.0 and 13.30.0.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00264 18th percentileScored 2026-11-07
Fix Fixed framework (laravel): 12.69.0, 13.30.0laravel/framework (Packagist): 12.69.0, 13.30.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Laravel | framework | before 12.69.0; 13.0.0 to before 13.30.0 | 12.69.0, 13.30.0 | Patch available | CNA |
| — | laravel/framework (Packagist) | before 12.69.0 | 12.69.0 | Patch available | GHSA-jh5r-qr3c-85q8 |
| — | laravel/framework (Packagist) | 13.0.0 to before 13.30.0 | 13.30.0 | Patch available | GHSA-jh5r-qr3c-85q8 |
- framework VendorLaravel Affected before 12.69.0; 13.0.0 to before 13.30.0 Fixed in 12.69.0, 13.30.0 Patch available CNA
- laravel/framework (Packagist) Vendor— Affected before 12.69.0 Fixed in 12.69.0 Patch available GHSA-jh5r-qr3c-85q8
- laravel/framework (Packagist) Vendor— Affected 13.0.0 to before 13.30.0 Fixed in 13.30.0 Patch available GHSA-jh5r-qr3c-85q8
Remediation
- Fix · CNA framework (laravel) Fixed in 12.69.0, 13.30.0
- Fix · GHSA-jh5r-qr3c-85q8 laravel/framework (Packagist) Fixed in 12.69.0 Advisory →
- Fix · GHSA-jh5r-qr3c-85q8 laravel/framework (Packagist) Fixed in 13.30.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-102279
- 2026-10-03 Alias added: GHSA-jh5r-qr3c-85q8
References
Other 6
- https://github.com/laravel/framework/security/advisories/GHSA-jh5r-qr3c-85q8
- https://github.com/laravel/framework/pull/61381
- https://github.com/laravel/framework/commit/b495ca2ec4e15a977e8700328bf13e8a79f29d12
- https://github.com/laravel/framework/releases/tag/v12.69.0
- https://github.com/laravel/framework/releases/tag/v13.30.0
- https://github.com/laravel/framework
More Laravel vulnerabilities
- TI-2021-02221 Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated… KEVCVSS 3.1CRITICAL 9.8
- TI-2025-33912 Livewire vulnerable to remote command execution during property update hydration KEVCVSS 4.0CRITICAL 9.2
- TI-2018-10827 In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might… KEVCVSS 3.1HIGH 8.1
- TI-2021-09454 A deserialization vulnerability in the destruct() function of Laravel v8.5.9 allows… CVSS 3.1CRITICAL 9.8
- TI-2022-02662 laravel deserialization CVSS 3.1CRITICAL 9.8
- TI-2017-12436 In Laravel framework through 5.5.21, remote attackers can obtain sensitive information… CVSS 3.0HIGH 7.5
Sources
- CVE-2026-102279 · CVE Program
- CVE-2026-102279 · NVD
- FIRST EPSS
- GHSA-jh5r-qr3c-85q8 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences