- Package
- laravel/framework
- Fixed in
- 12.69.0, 13.30.0
- Published
- Tue 29 Sep 2026, 19:24 LisbonUpdated Mon 26 Oct 2026, 03:26 Lisbon
- Installs on Packagist
- 603M
In plain words
An attacker can cause attacker-controlled input to run as script in the browser through a tooltip on Laravel's debug page. This requires APP_DEBUG=true and happens when the mouse hovers over the affected tooltip, which uses Tippy.js with allowHTML: true.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| laravel/framework | < 12.69.0 | 12.69.0 |
| laravel/framework | >= 13.0.0, < 13.30.0 | 13.30.0 |
Am I affected?
Look for laravel/framework in composer.lock. Affected versions are below 12.69.0, or at least 13.0.0 but below 13.30.0. Check whether APP_DEBUG=true; the described flaw involves a debug-page Tippy.js tooltip configured with allowHTML: true. Fixed versions are 12.69.0 and 13.30.0.
What to do
Check which version you have, then update to a fixed release for your branch (12.69.0, 13.30.0):
composer show laravel/framework | grep versions
composer update laravel/frameworkIf your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.
The advisory's description
Impact
When APP_DEBUG=true, attacker-controlled input is passed to a Tippy.js tooltip configured with allowHTML: true, enabling DOM-based XSS during mouse hover.
Patches
Weakness: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS). Reported by Rikuxx0.
The advisory
- GitHub Advisory Database: GHSA-jh5r-qr3c-85q8, with who is affected and how
- OSV.dev: GHSA-jh5r-qr3c-85q8
- The week's digest, with the other advisories from 28 Sep 2026
- All advisories for laravel/framework