Security advisoryCVE-2024-13919
Laravel framework susceptible to reflected cross-site scripting
The Laravel framework versions between 11.9.0 and 11.35.1 are susceptible to reflected cross-site scripting due to an improper encoding of route parameters in the debug-mode error page.
As published by the sources
Affected packages
- Affected
>=11.9.0,<11.36.0Fixed in11.36.0
Derived from the fixed versions above
What to do
Upgrade laravel/framework to 11.36.0 or later.
composer update laravel/framework --with-dependencies
To see which version you have installed, run composer show vendor/package. Running composer audit lists the known advisories that match your installed versions.
Quoted from the original advisory
Details
The Laravel framework versions between 11.9.0 and 11.35.1 are susceptible to reflected cross-site scripting due to an improper encoding of route parameters in the debug-mode error page.
References
- Advisoryhttps://github.com/sbaresearch/advisories/tree/public/2024/SBA-ADV-20241209-02_Laravel_Reflected_XSS_via_Route_Parameter_in_Debug-Mode_Error_Page
- Advisoryhttps://nvd.nist.gov/vuln/detail/CVE-2024-13919
- Webhttps://github.com/laravel/framework/pull/53869
- Webhttps://github.com/laravel/framework/commit/45287fb2a91c69bb1c110539b9b7341faf5aee33
- Webhttps://github.com/FriendsOfPHP/security-advisories/blob/master/laravel/framework/CVE-2024-13919.yaml
- Packagehttps://github.com/laravel/framework
- Webhttps://github.com/laravel/framework/releases/tag/v11.36.0
- Webhttp://www.openwall.com/lists/oss-security/2025/03/10/4