Log in Start free

Vulnerability · Published Sep 28, 2026 · Assigned by GitHub_M

CVE-2026-102279Laravel: XSS in Debug Page Information

Low 3.1

In plain English

A low-severity security flaw in framework from laravel. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.1Low
Exploit odds (30 days)0.3%top 81.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Laravel is a web application framework. Prior to 12.69.0 and 13.30.0, Laravel exception debug pages with APP_DEBUG=true pass attacker-controlled input to a Tippy.js tooltip configured with allowHTML true, enabling DOM-based cross-site scripting when a user hovers over the tooltip. This issue is fixed in versions 12.69.0 and 13.30.0.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12php-laravel-frameworkno fix listedDEBIAN-CVE-2026-102279
Debian:13php-laravel-frameworkno fix listedDEBIAN-CVE-2026-102279
Debian:14php-laravel-framework13.31.0+dfsg-1DEBIAN-CVE-2026-102279
Packagistlaravel/framework12.69.0GHSA-jh5r-qr3c-85q8
Packagistlaravel/framework13.30.0GHSA-jh5r-qr3c-85q8

Affected products (as reported)

VendorProductVersions
laravel framework < 12.69.0>= 13.0.0, < 13.30.0

Weakness: CWE-80 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

References