CVE-2026-102279

Received Received - Intake

Laravel Exception Debug Page DOM XSS via Tippy.js

Publication date: 2026-09-28

Last updated on: 2026-09-28

Assigner: GitHub, Inc.

Description

Laravel is a web application framework. Prior to 12.69.0 and 13.30.0, Laravel exception debug pages with APP_DEBUG=true pass attacker-controlled input to a Tippy.js tooltip configured with allowHTML true, enabling DOM-based cross-site scripting when a user hovers over the tooltip. This issue is fixed in versions 12.69.0 and 13.30.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-28

Last Modified

2026-09-28

Generated

2026-09-29

AI Q&A

2026-09-29

EPSS Evaluated

N/A

NVD

CVE-2026-102279

Affected Vendors & Products

Vendor	Product	Version / Range
laravel	laravel	to 13.30.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-80	The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.

Attack-Flow Graph

Executive Summary

This vulnerability involves Laravel's exception debug pages. When APP_DEBUG is set to true, attacker-controlled input is passed to a Tippy.js tooltip configured with allowHTML set to true. This allows for DOM-based cross-site scripting when a user hovers over the tooltip.

Detection Guidance

This vulnerability is specific to Laravel applications with APP_DEBUG=true and Tippy.js tooltips configured with allowHTML=true. Detection requires checking Laravel version and inspecting debug pages for tooltip configurations. No direct network commands detect this; manual code review is needed.

Impact Analysis

An attacker could exploit this to execute malicious scripts in the context of your web application. This could lead to unauthorized actions, data theft, or session hijacking if users interact with the affected tooltip.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate GDPR (data protection) and HIPAA (health information privacy) requirements. Compliance could be impacted if user data is compromised.

Mitigation Strategies

Upgrade Laravel to version 12.69.0 or 13.30.0 or later. Set APP_DEBUG=false in production environments. Review and remove Tippy.js tooltips with allowHTML=true from debug pages.

Hi! I’m here to help you understand CVE-2026-102279. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70