Laravel: XSS in Debug Page Information

[ Description ]Official description

Laravel is a web application framework. Prior to 12.69.0 and 13.30.0, Laravel exception debug pages with APP_DEBUG=true pass attacker-controlled input to a Tippy.js tooltip configured with allowHTML true, enabling DOM-based cross-site scripting when a user hovers over the tooltip. This issue is fixed in versions 12.69.0 and 13.30.0.

[ Fixes ]Fixes and patches

• laravel/framework 12.69.0Fixed version · GitHub Advisories · composer package laravel/framework: upgrade to 12.69.0 or later (affected < 12.69.0)
• laravel/framework 13.30.0Fixed version · GitHub Advisories · composer package laravel/framework: upgrade to 13.30.0 or later (affected >= 13.0.0, < 13.30.0)

[ Advisories ]Government CERT advisories

• BSI CERT-Bund19 Oct 2026WID-SEC-2026-4047

  Snipe-IT: Multiple vulnerabilities Translated from German

  CVE-2026-109413CVE-2026-55599CVE-2026-45073+9 more CVEs

[ Packages ]Affected open-source packages

• laravel/framework composerAffected < 12.69.0 · fixed in 12.69.0 · GHSA-jh5r-qr3c-85q8
• laravel/framework composerAffected >= 13.0.0, < 13.30.0 · fixed in 13.30.0 · GHSA-jh5r-qr3c-85q8

[ References ]References

• github.com/laravel/framework/commit/b495ca2ec4e15a977e8700328bf13e8a79f29d12
• github.com/laravel/framework/pull/61381
• github.com/laravel/framework/releases/tag/v12.69.0
• github.com/laravel/framework/releases/tag/v13.30.0
• github.com/laravel/framework/security/advisories/GHSA-jh5r-qr3c-85q8