{"id":"CVE-2026-102279","revision":"528d8e8a03954f5289fe21973f4e07ae","records":[{"revision":"528d8e8a03954f5289fe21973f4e07ae","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-102279","aliases":[],"title":"Laravel: XSS in Debug Page Information","description":"Laravel is a web application framework. Prior to 12.69.0 and 13.30.0, Laravel exception debug pages with APP_DEBUG=true pass attacker-controlled input to a Tippy.js tooltip configured with allowHTML true, enabling DOM-based cross-site scripting when a user hovers over the tooltip. This issue is fixed in versions 12.69.0 and 13.30.0.","state":0,"publishedAt":"2026-09-28T20:59:36.528+00:00","modifiedAt":"2026-09-29T14:44:03.594+00:00","affected":[{"ecosystem":"Vendor product","name":"framework","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"laravel\",\n                    \"product\": \"framework\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 12.69.0\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 13.0.0, < 13.30.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N","score":3.1,"severity":"LOW"}],"references":["https://github.com/laravel/framework/security/advisories/GHSA-jh5r-qr3c-85q8","https://github.com/laravel/framework/pull/61381","https://github.com/laravel/framework/commit/b495ca2ec4e15a977e8700328bf13e8a79f29d12","https://github.com/laravel/framework/releases/tag/v12.69.0","https://github.com/laravel/framework/releases/tag/v13.30.0"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-102279","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-102279","identifiers":["CVE-2026-102279"]},"retained":false,"historicalAffected":[]}],"coverage":[]}