要点
- CVE-2026-102279 是影响 laravel/framework 的低危 (CVSS 3.1)漏洞。
- 未来 30 天内被利用的概率（EPSS）：0.26%，高于 18.2% 的漏洞。
- 修复：升级到 13.30.0, 12.69.0 或更高版本。
| Package | Affected versions | Patched versions |
|---|
| laravel/framework Packagist | ≥ 13.0.0, < 13.30.0< 12.69.0
| 13.30.012.69.0
|
Description
Impact
When APP_DEBUG=true, attacker-controlled input is passed to a Tippy.js tooltip configured with allowHTML: true, enabling DOM-based XSS during mouse hover.
Patches
#61381
NVD description
Laravel is a web application framework. Prior to 12.69.0 and 13.30.0, Laravel exception debug pages with APP_DEBUG=true pass attacker-controlled input to a Tippy.js tooltip configured with allowHTML true, enabling DOM-based cross-site scripting when a user hovers over the tooltip. This issue is fixed in versions 12.69.0 and 13.30.0.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free