CVE-2026-102279

Summary

Laravel: XSS in Debug Page Information

Severity

low

CVSS

3.1

EPSS

0.3% (p18)

CWE

CWE-80

Also known as

GHSA-jh5r-qr3c-85q8

Published

2026-09-29

Updated

2026-09-29

Advisory details

Impact

When APP_DEBUG=true, attacker-controlled input is passed to a Tippy.js tooltip configured with allowHTML: true, enabling DOM-based XSS during mouse hover.

Patches

#61381

References

• https://github.com/advisories/GHSA-jh5r-qr3c-85q8
• https://github.com/laravel/framework/security/advisories/GHSA-jh5r-qr3c-85q8
• https://nvd.nist.gov/vuln/detail/CVE-2026-102279
• https://github.com/laravel/framework/pull/61381
• https://github.com/laravel/framework/commit/b495ca2ec4e15a977e8700328bf13e8a79f29d12
• https://github.com/laravel/framework/releases/tag/v12.69.0
• https://github.com/laravel/framework/releases/tag/v13.30.0

Related advisories

• CVE-2026-114509 — critical · Packagist/laravel/framework
• GHSA-qm5c-m76r-2hfr — critical · Packagist/laravel/framework
• GHSA-5vg9-5847-vvmq — high · Packagist/laravel/framework
• CVE-2024-52301 — high · Packagist/laravel/framework
• GHSA-wq8p-mqvg-2p5h — high · Packagist/laravel/framework
• GHSA-jwvj-pwww-3mj5 — high · Packagist/laravel/framework
• GHSA-6jvx-8ch9-j2jr — high · Packagist/laravel/framework
• CVE-2018-15133 — high · Packagist/laravel/framework

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity