DailyCVE@dailycve
🔵 Laravel: XSS in Debug Page Information - #CVE-2026-102279 (Low) -DC-Sep2026-2627 https://dailycve.com/laravel-xss-in-debug-page-information-cve-2026-102279-low-dc-sep2026-2627/
0000022
238 followersView on X
CVE-2026-102279
LOWCVSS 3.1 · LOWSignal is active with 1 mentions in latest observed window
Immediate actions
- Track advisory updates for patch or workaround availability
Recommended action window: Monitor and triage in normal cycle
NVD description
Laravel is a web application framework. Prior to 12.69.0 and 13.30.0, Laravel exception debug pages with APP_DEBUG=true pass attacker-controlled input to a Tippy.js tooltip configured with allowHTML true, enabling DOM-based cross-site scripting when a user hovers over the tooltip. This issue is fixed in versions 12.69.0 and 13.30.0.
0.0/ 10 priority
Sources & remediation
Other references
- https://github.com/laravel/framework/commit/b495ca2ec4e15a977e8700328bf13e8a79f29d12
- https://github.com/laravel/framework/pull/61381
- https://github.com/laravel/framework/releases/tag/v12.69.0
- https://github.com/laravel/framework/releases/tag/v13.30.0
- https://github.com/laravel/framework/security/advisories/GHSA-jh5r-qr3c-85q8
Weakness type (CWE)
CWE-80
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
Threat summary
- 1 mentions across 1 observed day
What's happening
- 1 total mentions across 1 day