Vulnerability GHSA-jh5r-qr3c-85q8
Low Risk
LOW RISK
CVSS Score: 3.1
Score Range: < 4.0
Low severity vulnerabilities (CVSS < 4.0). Hygiene issues that can accumulate but pose lower immediate risk.
6 hours ago
September 29, 2026 at 06:24 PM UTC
Laravel: XSS in Debug Page Information
4.0.0-BETA2 - 12.68.0 and 13.0.0 - 13.29.0
4.0.0-BETA2 - 12.68.0 and 13.0.0 - 13.29.0
Summary
Laravel: XSS in Debug Page Information
Details
Impact
When APP_DEBUG=true, attacker-controlled input is passed to a Tippy.js tooltip configured with allowHTML: true, enabling DOM-based XSS during mouse hover.
Patches
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Medium Risk
3 months ago
Laravel Framework: Temporary Signed URL Path Confusion
4.0.0-BETA2 - 11.56.1 and 12.0.0 - 12.61.0 and 13.0.0 - 13.11.2 GHSA-crmm-hgp2-wgrp
4.0.0-BETA2 - 11.56.1 and 12.0.0 - 12.61.0 and 13.0.0 - 13.11.2 GHSA-crmm-hgp2-wgrp
High Risk
3 months ago
Laravel Framework: CRLF injection in default email rule
4.0.0-BETA2 - 11.56.1 and 12.0.0 - 12.59.0 and 13.0.0 - 13.9.0 GHSA-5vg9-5847-vvmq
4.0.0-BETA2 - 11.56.1 and 12.0.0 - 12.59.0 and 13.0.0 - 13.9.0 GHSA-5vg9-5847-vvmq
Medium Risk
1 year ago
Laravel framework susceptible to reflected cross-site scripting
11.9.0 - 11.35.1 GHSA-546h-56qp-8jmw
11.9.0 - 11.35.1 GHSA-546h-56qp-8jmw
Medium Risk
1 year ago
Laravel framework susceptible to reflected cross-site scripting
11.9.0 - 11.35.1 GHSA-83wp-f5c3-hqqr
11.9.0 - 11.35.1 GHSA-83wp-f5c3-hqqr
Medium Risk
1 year ago
Laravel has a File Validation Bypass
4.0.0-BETA2 - 10.48.28 and 11.0.0 - 11.44.0 and 12.0.0 - 12.1.0 GHSA-78fx-h6xr-vch4
4.0.0-BETA2 - 10.48.28 and 11.0.0 - 11.44.0 and 12.0.0 - 12.1.0 GHSA-78fx-h6xr-vch4
Impacted packages
Timeline
Published
6 hours ago
September 29, 2026 at 06:24 PM UTC
Fixed (13.30.0)
28 days ago
September 01, 2026 at 01:19 PM UTC
Fixed (12.69.0)
28 days ago
September 01, 2026 at 01:24 PM UTC
Last Modified
6 hours ago
September 29, 2026 at 06:30 PM UTC