Read the docs
TI-2026-83855 Aliases CVE-2026-120488GHSA-5g7w-8vm6-6hg2

Stored cross-site scripting in LaraDashboard LaraBuilder blocks

Priority LOW 23CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

LaraDashboard before 1.4.9 contains a stored cross-site scripting flaw (CWE-79) because LaraBuilder design_json block content is not sanitized. An authenticated user with post.create or post.edit permission can save text-editor, HTML, text or heading blocks containing script or event-handler markup. The injected script runs in administrator or Superadmin sessions that view the builder, preview or page.

Written with Claude Haiku 5.5 from the sources below · 2026-11-02

Description from the CNA

LaraDashboard before 1.4.9 contains a stored cross-site scripting vulnerability that allows authenticated users with post.create or post.edit permission to inject scripts via unsanitized LaraBuilder design_json block content. Attackers can save text-editor, HTML, text or heading blocks containing script or event-handler markup that executes in administrator or Superadmin sessions viewing the builder, preview or page.

Why it matters now

EPSS 0.00218 12th percentileScored 2026-11-07
Fix Fixed LaraDashboard (LaraDashboard): 1.4.9

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
laradashboardLaraDashboardbefore 1.4.91.4.9Patch availableCNA
  • LaraDashboard Vendorlaradashboard Affected before 1.4.9 Fixed in 1.4.9 Patch available CNA

Remediation

Update LaraDashboard to version 1.4.9, which is the fixed version.

Written with Claude Haiku 5.5 from the sources below · 2026-11-02

  • Fix · CNA LaraDashboard (LaraDashboard) Fixed in 1.4.9

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    LaraDashboard 1.4.9

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-83842 LaraDashboard Improper Authorization in MCP send-email ToolPriority MEDIUM 57
    Show all 2 records →

Timeline

  1. 2026-11-02 Threatist record created from CVE-2026-120488
  2. 2026-11-02 Alias added: GHSA-5g7w-8vm6-6hg2

References

Patch 1

Advisory 3

Other 2

  • TI-2026-83854 LaraDashboard lets non-Superadmin admins access core upgrade actions CVSS 4.0HIGH 8.6
  • TI-2026-61796 LaraDashboard 0.9.2 through 1.2.2 Path Traversal RCE CVSS 4.0HIGH 8.6
  • TI-2026-59145 Lara Dashboard before 1.3.2 Incorrect Authorization in Core-Upgrade Archive Upload CVSS 4.0HIGH 8.6
  • TI-2026-67502 LaraDashboard 1.4.2 before 1.4.8 Resource Exhaustion via Password Recovery Endpoints CVSS 4.0MEDIUM 6.9
  • TI-2026-67504 LaraDashboard before 1.4.8 Incorrect Authorization Exposes Secrets via Settings API CVSS 4.0HIGH 7.1
  • TI-2026-61797 laradashboard through 1.2.2 Missing Authorization via License API CVSS 4.0HIGH 7.1
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences