CVE-2026-102279

3.1 Faible

Publiée le 28/09/2026 à 23:17 · Modifiée le 30/09/2026 à 21:38 · En attente d'analyse NVD · Source : security-advisories@github.com

Description

Laravel is a web application framework. Prior to 12.69.0 and 13.30.0, Laravel exception debug pages with APP_DEBUG=true pass attacker-controlled input to a Tippy.js tooltip configured with allowHTML true, enabling DOM-based cross-site scripting when a user hovers over the tooltip. This issue is fixed in versions 12.69.0 and 13.30.0.

Traduire en français

Produits concernés

laravel framework

Scores CVSS

Version	Score	Source	Vecteur
3.1	3.1 Faible	security-advisories@github.com	`CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N`

Faiblesses (CWE)

CWE-80

Références

https://github.com/laravel/framework/commit/b495ca2ec4e15a977e8700328bf13e8a79f29d12
https://github.com/laravel/framework/pull/61381
https://github.com/laravel/framework/releases/tag/v12.69.0
https://github.com/laravel/framework/releases/tag/v13.30.0
https://github.com/laravel/framework/security/advisories/GHSA-jh5r-qr3c-85q8

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories