CVE-2026-102279

LowCVSS 3.1

Published: 28/09/2026(UTC)Updated: 30/09/2026(UTC)Translated: 29/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

9th percentile - higher than 9% of all known CVEs

Summary

In Laravel prior to versions 12.69.0 and 13.30.0, exception debug pages with APP_DEBUG=true pass attacker-controlled input to a Tippy.js tooltip configured with allowHTML=true, enabling DOM-based cross-site scripting when a user hovers over the tooltip.

Risk Assessment

An attacker can execute arbitrary JavaScript in the victim's browser, potentially leading to session or data theft. The risk only applies when debug mode (APP_DEBUG=true) is enabled, which should not be active in production.

Recommendation

Update Laravel to version 12.69.0 or 13.30.0. Ensure APP_DEBUG is disabled in production environments.

Other vulnerabilities in Laravel

CVE-2026-48019High
Laravel before versions 12.60.0 and 13.10.0 has a CRLF injection vulnerability in email validation, which combined with Symfony Mailer and Symfony Mime handling of certain character sequences, may allow an unauthenticated attacker to interfere with outbound email processing. Patched in 12.60.0 and 13.10.0.

Original NVD description (English source)

Laravel is a web application framework. Prior to 12.69.0 and 13.30.0, Laravel exception debug pages with APP_DEBUG=true pass attacker-controlled input to a Tippy.js tooltip configured with allowHTML true, enabling DOM-based cross-site scripting when a user hovers over the tooltip. This issue is fixed in versions 12.69.0 and 13.30.0.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS