All vulnerabilities
CVE-2026-102279GHSA-jh5r-qr3c-85q8

laravel/framework: Laravel: XSS in Debug Page Information

laravel laravel/frameworkcomposerFrameworks
Open in ThreatlineRecord JSON
CVSS
3.1Low
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.20%Chance of exploitation activity in the next 30 days, higher than 9% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in12.69.0Also 13.30.0GitHub
Published28 Sep 2026Updated 29 Sep 2026CVE List

What fixes it

  • 12.69.0laravel/framework, composerGitHubcomposer require "laravel/framework:^12.69.0"
  • 13.30.0laravel/framework, composerGitHubcomposer require "laravel/framework:^13.30.0"
  • 12.69.0laravel/framework, PackagistOSVcomposer require "laravel/framework:^12.69.0"
  • 13.30.0laravel/framework, PackagistOSVcomposer require "laravel/framework:^13.30.0"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Impact

When APP_DEBUG=true, attacker-controlled input is passed to a Tippy.js tooltip configured with allowHTML: true, enabling DOM-based XSS during mouse hover.

Patches

#61381

Text from GitHub Advisory Database

Affected versions 95

  • laravel/framework, composer< 12.69.0GitHub
  • laravel/framework, composer>= 13.0.0, < 13.30.0GitHub
  • frameworkaffected: < 12.69.0CVE List
  • frameworkaffected: >= 13.0.0, < 13.30.0CVE List
  • laravel/framework, composer<v12.69.0GitHub
  • laravel/framework, composer<v13.30.0GitHub
  • laravel/framework, Packagistfrom first release, fixed in 12.69.0OSV
  • laravel/framework, Packagist10.50.2OSV
  • laravel/framework, Packagist5.0.30OSV
  • laravel/framework, Packagist5.2.41OSV
  • laravel/framework, Packagistv10.0.0OSV
  • laravel/framework, Packagistv10.0.1OSV
  • laravel/framework, Packagistv10.0.2OSV
  • laravel/framework, Packagistv10.0.3OSV
  • laravel/framework, Packagistv10.1.0OSV
  • laravel/framework, Packagistv10.1.1OSV
  • laravel/framework, Packagistv10.1.2OSV
  • laravel/framework, Packagistv10.1.3OSV
  • laravel/framework, Packagistv10.1.4OSV
  • laravel/framework, Packagistv10.1.5OSV
  • laravel/framework, Packagistv10.10.0OSV
  • laravel/framework, Packagistv10.10.1OSV
  • laravel/framework, Packagistv10.11.0OSV
  • laravel/framework, Packagistv10.12.0OSV
  • laravel/framework, Packagistv10.13.0OSV
  • laravel/framework, Packagistv10.13.1OSV
  • laravel/framework, Packagistv10.13.2OSV
  • laravel/framework, Packagistv10.13.3OSV
  • laravel/framework, Packagistv10.13.5OSV
  • laravel/framework, Packagistv10.14.0OSV
  • laravel/framework, Packagistv10.14.1OSV
  • laravel/framework, Packagistv10.15.0OSV
  • laravel/framework, Packagistv10.16.0OSV
  • laravel/framework, Packagistv10.16.1OSV
  • laravel/framework, Packagistv10.17.0OSV
  • laravel/framework, Packagistv10.17.1OSV
  • laravel/framework, Packagistv10.18.0OSV
  • laravel/framework, Packagistv10.19.0OSV
  • laravel/framework, Packagistv10.2.0OSV
  • laravel/framework, Packagistv10.20.0OSV
  • laravel/framework, Packagistv10.21.0OSV
  • laravel/framework, Packagistv10.21.1OSV
  • laravel/framework, Packagistv10.22.0OSV
  • laravel/framework, Packagistv10.23.0OSV
  • laravel/framework, Packagistv10.23.1OSV
  • laravel/framework, Packagistv10.24.0OSV
  • laravel/framework, Packagistv10.25.0OSV
  • laravel/framework, Packagistv10.25.1OSV
  • laravel/framework, Packagistv10.25.2OSV
  • laravel/framework, Packagistv10.26.0OSV
  • laravel/framework, Packagistv10.26.1OSV
  • laravel/framework, Packagistv10.26.2OSV
  • laravel/framework, Packagistv10.27.0OSV
  • laravel/framework, Packagistv10.28.0OSV
  • laravel/framework, Packagistv10.29.0OSV
  • laravel/framework, Packagistv10.3.0OSV
  • laravel/framework, Packagistv10.3.1OSV
  • laravel/framework, Packagistfrom 13.0.0, fixed in 13.30.0OSV
  • laravel/framework, Packagistv13.0.0OSV
  • laravel/framework, Packagistv13.1.0OSV
  • laravel/framework, Packagistv13.1.1OSV
  • laravel/framework, Packagistv13.10.0OSV
  • laravel/framework, Packagistv13.11.0OSV
  • laravel/framework, Packagistv13.11.1OSV
  • laravel/framework, Packagistv13.11.2OSV
  • laravel/framework, Packagistv13.12.0OSV
  • laravel/framework, Packagistv13.13.0OSV
  • laravel/framework, Packagistv13.14.0OSV
  • laravel/framework, Packagistv13.15.0OSV
  • laravel/framework, Packagistv13.16.0OSV
  • laravel/framework, Packagistv13.16.1OSV
  • laravel/framework, Packagistv13.17.0OSV
  • laravel/framework, Packagistv13.18.0OSV
  • laravel/framework, Packagistv13.18.1OSV
  • laravel/framework, Packagistv13.19.0OSV
  • laravel/framework, Packagistv13.2.0OSV
  • laravel/framework, Packagistv13.20.0OSV
  • laravel/framework, Packagistv13.21.0OSV
  • laravel/framework, Packagistv13.21.1OSV
  • laravel/framework, Packagistv13.22.0OSV
  • laravel/framework, Packagistv13.23.0OSV
  • laravel/framework, Packagistv13.24.0OSV
  • laravel/framework, Packagistv13.25.0OSV
  • laravel/framework, Packagistv13.26.0OSV
  • laravel/framework, Packagistv13.26.1OSV
  • laravel/framework, Packagistv13.27.0OSV
  • laravel/framework, Packagistv13.28.0OSV
  • laravel/framework, Packagistv13.29.0OSV
  • laravel/framework, Packagistv13.3.0OSV
  • laravel/framework, Packagistv13.4.0OSV
  • laravel/framework, Packagistv13.5.0OSV
  • laravel/framework, Packagistv13.6.0OSV
  • laravel/framework, Packagistv13.7.0OSV
  • laravel/framework, Packagistv13.8.0OSV
  • laravel/framework, Packagistv13.9.0OSV

References 7