Security advisoryCVE-2026-102279

Laravel: XSS in Debug Page Information

Low3.1Published Sep 29, 2026Modified Sep 29, 2026Original advisory

As published by the sources

Affected packages

laravel/framework
Affected<12.69.0 || >=13.0.0,<13.30.0
Fixed in12.69.013.30.0

Derived from the fixed versions above

What to do

1
Upgrade laravel/framework to the fixed version in your release line: 12.69.0, 13.30.0.
```
composer update laravel/framework --with-dependencies
```

To see which version you have installed, run composer show vendor/package. Running composer audit lists the known advisories that match your installed versions.

Quoted from the original advisory

Details

Impact

When APP_DEBUG=true, attacker-controlled input is passed to a Tippy.js tooltip configured with allowHTML: true, enabling DOM-based XSS during mouse hover.

Patches

#61381

References

Advisoryhttps://github.com/advisories/GHSA-jh5r-qr3c-85q8
Webhttps://github.com/laravel/framework/security/advisories/GHSA-jh5r-qr3c-85q8
Advisoryhttps://nvd.nist.gov/vuln/detail/CVE-2026-102279
Webhttps://github.com/laravel/framework/pull/61381
Webhttps://github.com/laravel/framework/commit/b495ca2ec4e15a977e8700328bf13e8a79f29d12
Packagehttps://github.com/laravel/framework
Webhttps://github.com/laravel/framework/releases/tag/v12.69.0
Webhttps://github.com/laravel/framework/releases/tag/v13.30.0