| Package | Affected versions | Patched versions |
|---|---|---|
| backpack/crud | ≥ 6.0.0, < 6.8.14≥ 7.0.0, < 7.0.38 | 6.8.147.0.38 |
The Blade template for the color column type (src/resources/views/crud/columns/color.blade.php) has its escaped/unescaped rendering branches inverted relative to every other column template in the library. Because $column['escaped'] defaults to true, values stored in color columns are rendered unescaped by default, enabling Stored XSS if column values are not validated before storage.
All other column templates in src/resources/views/crud/columns/ follow the convention:
$column['escaped'] == true → {{ $column['text'] }} (HTML-escaped)$column['escaped'] == false → {!! $column['text'] !!} (raw)The color template has these branches swapped. An attacker who can write an arbitrary string to a color-typed column can inject JavaScript that executes in the browser of any user who views the list — including administrators — with access to their session cookies and CSRF tokens.
Stored XSS with scope change (attacker context runs in victim's browser). Highest-risk target is an administrator viewing the list view. Exploitability requires the ability to write an unsanitized value into a color-typed column.
Fixed in 6.8.14 and 7.0.38 by correcting the branch order in color.blade.php. See PR #5992.
Validate stored color values against a strict CSS color grammar (e.g. /^#[0-9a-fA-F]{3,6}$/) at the model layer before data reaches the view.
Reported by Vishal Shukla (@shukla304) via sechub.dev.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free