GitHub Advisoryadvisory · Packagist

GHSA-jh5r-qr3c-85q8 Laravel: XSS in Debug Page Information

LOW Published 2026-09-29 Modified 2026-09-29 Official page ↗

Aliases: CVE-2026-102279
Ecosystem: Packagist
Packages: laravel/framework
Severity: Low
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
Weaknesses: CWE-80
Reviewed: 2026-09-29

Affected packages

• Packagist laravel/framework: < 12.69.0 → fixed in 12.69.0 • Packagist laravel/framework: >= 13.0.0, < 13.30.0 → fixed in 13.30.0

Description

Impact When `APP_DEBUG=true`, attacker-controlled input is passed to a Tippy.js tooltip configured with `allowHTML: true`, enabling DOM-based XSS during mouse hover. Patches #61381

Alias · CVE (1)

CVE-2026-102279 Laravel is a web application framework. vulnerability

Weakness · CWE (1)

CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page weakness

References