CVE-2026-102279

Published: Set 28, 2026 Last Modified: Set 28, 2026
ExploitDB:
Other exploit source:
Google Dorks:
LOW 3,1
Source: [email protected]
Attack Vector: network
Attack Complexity: high
Privileges Required: none
User Interaction: required
Scope: unchanged
Confidentiality: none
Integrity: low
Availability: none

Description

AI Translation Available

Laravel is a web application framework. Prior to 12.69.0 and 13.30.0, Laravel exception debug pages with APP_DEBUG=true pass attacker-controlled input to a Tippy.js tooltip configured with allowHTML true, enabling DOM-based cross-site scripting when a user hovers over the tooltip. This issue is fixed in versions 12.69.0 and 13.30.0.

80

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Incomplete
Abstraction: Variant Structure: Simple
Common Consequences
Security Scopes Affected:
Confidentiality Integrity Availability
Potential Impacts:
Read Application Data Execute Unauthorized Code Or Commands
Applicable Platforms
Technologies: Web Based, Web Server
Likelihood of Exploit: High
View CWE Details
https://github.com/laravel/framework/commit/b495ca2ec4e15a9…
https://github.com/laravel/framework/commit/b495ca2ec4e15a977e8700328bf13e8a79f…
https://github.com/laravel/framework/pull/61381
https://github.com/laravel/framework/pull/61381
https://github.com/laravel/framework/releases/tag/v12.69.0
https://github.com/laravel/framework/releases/tag/v12.69.0
https://github.com/laravel/framework/releases/tag/v13.30.0
https://github.com/laravel/framework/releases/tag/v13.30.0
https://github.com/laravel/framework/security/advisories/GH…
https://github.com/laravel/framework/security/advisories/GHSA-jh5r-qr3c-85q8