{"id":"CVE-2026-102279","published":"2026-09-28T20:59:36Z","modified":"2026-09-29T14:44:03Z","title":"Laravel: XSS in Debug Page Information","vendor":"laravel","product":"framework","tier":"tail","description":{"text":"Laravel is a web application framework. Prior to 12.69.0 and 13.30.0, Laravel exception debug pages with APP_DEBUG=true pass attacker-controlled input to a Tippy.js tooltip configured with allowHTML true, enabling DOM-based cross-site scripting when a user hovers over the tooltip. This issue is fixed in versions 12.69.0 and 13.30.0.","provenance":"source","from":"CVE.org"},"cvss":{"score":3.1,"severity":"LOW","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00264,"percentile":0.1819,"provenance":"source"},"cwes":[{"id":"CWE-80","name":"Improper Neutralization of Script-Related HTML Tags in a Web Page"}],"references":[{"url":"https://github.com/laravel/framework/security/advisories/GHSA-jh5r-qr3c-85q8","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/laravel/framework/pull/61381","tags":["x_refsource_MISC"]},{"url":"https://github.com/laravel/framework/commit/b495ca2ec4e15a977e8700328bf13e8a79f29d12","tags":["x_refsource_MISC"]},{"url":"https://github.com/laravel/framework/releases/tag/v12.69.0","tags":["x_refsource_MISC"]},{"url":"https://github.com/laravel/framework/releases/tag/v13.30.0","tags":["x_refsource_MISC"]}],"priority":{"score":5.8,"factors":[{"name":"EPSS percentile","points":3.64},{"name":"CVSS severity","points":2.17}]},"vendorSlug":"laravel","affectedVersions":[{"vendor":"laravel","product":"framework","versions":["< 12.69.0",">= 13.0.0, < 13.30.0"]}],"affected":[{"ecosystem":"Packagist","package":"laravel/framework","vulnerableRanges":["<12.69.0",">=13.0.0, <13.30.0"],"patched":["12.69.0","13.30.0"],"from":["GHSA-jh5r-qr3c-85q8"],"provenance":"source"}],"euvd":{"id":"EUVD-2026-88508","exploited":false,"provenance":"source"}}