Description
Laravel is a web application framework. Prior to 12.69.0 and 13.30.0, Laravel exception debug pages with APP_DEBUG=true pass attacker-controlled input to a Tippy.js tooltip configured with allowHTML true, enabling DOM-based cross-site scripting when a user hovers over the tooltip. This issue is fixed in versions 12.69.0 and 13.30.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| laravel | framework | < 12.69.0, >= 13.0.0, < 13.30.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | php-laravel-framework | 13.31.0+dfsg-1 | — |
| Debian 13 | php-laravel-framework | No fix yet | — |
| Debian 12 | php-laravel-framework | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | laravel/framework | < 12.69.0 | 12.69.0 | GHSA-jh5r-qr3c-85q8 |
| Packagist | laravel/framework | >= 13.0.0, < 13.30.0 | 13.30.0 | GHSA-jh5r-qr3c-85q8 |
Advisories 2
- WID-SEC-2026-4047 Snipe-IT: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 4, 2026
- WID-SEC-2026-3293 Laravel: Schwachstelle ermöglicht Cross-Site Scripting BSI CERT-Bund (WID) · Sep 28, 2026
References
- https://github.com/laravel/framework/security/advisories/GHSA-jh5r-qr3c-85q8
- https://github.com/laravel/framework/pull/61381
- https://github.com/laravel/framework/commit/b495ca2ec4e15a977e8700328bf13e8a79f29d12
- https://github.com/laravel/framework/releases/tag/v12.69.0
- https://github.com/laravel/framework/releases/tag/v13.30.0