Laravel: XSS in Debug Page Information

BAJO 3.1CVE-2026-102279 · GHSA-jh5r-qr3c-85q8 · Published 28/09/2026 · updated 30/09/2026

Package	Affected versions	Patched versions
laravel/framework Packagist	`≥ 13.0.0, < 13.30.0< 12.69.0`	`13.30.012.69.0`

Description

Impact

When APP_DEBUG=true, attacker-controlled input is passed to a Tippy.js tooltip configured with allowHTML: true, enabling DOM-based XSS during mouse hover.

Patches

#61381

NVD description

Laravel is a web application framework. Prior to 12.69.0 and 13.30.0, Laravel exception debug pages with APP_DEBUG=true pass attacker-controlled input to a Tippy.js tooltip configured with allowHTML true, enabling DOM-based cross-site scripting when a user hovers over the tooltip. This issue is fixed in versions 12.69.0 and 13.30.0.

References

laravel/framework security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2026-102279 · ADVISORY
laravel/framework#61381 · WEB
laravel/framework commit b495ca2 · WEB
laravel/framework · PACKAGE
laravel/framework release v12.69.0 · WEB
laravel/framework release v13.30.0 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free