CVE-2026-54181
Received Received - Intake

Stored XSS in Backpack CRUD Color Column

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: GitHub, Inc.

Description
backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.14 and 7.0.38, src/resources/views/crud/columns/color.blade.php inverts the escaped and raw rendering branches controlled by $column['escaped'], which defaults to true, causing $column['text'] to be rendered unescaped by default. An attacker who can store an unsanitized value in a color column can execute script in the browser of a user who views the CRUD list, including an administrator, with access to the victim's session-backed application capabilities. Exploitation requires write access to the stored color value and a victim viewing the list. This issue is fixed in versions 6.8.14 and 7.0.38.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-14
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-54181
EUVD
EUVD-2026-77720

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
backpack crud to 6.8.14 (inc)
backpack crud 7.0.38
laravel-backpack crud From 6.0.0 (inc) to 6.8.14 (exc)
laravel-backpack crud From 7.0.0 (inc) to 7.0.38 (exc)
laravel-backpack crud 6.8.14
laravel-backpack crud 7.0.38

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1023 The product performs a comparison between entities that must consider multiple factors or characteristics of each entity, but the comparison does not include one or more of these factors.
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored Cross-Site Scripting (XSS) vulnerability in the Laravel-Backpack CRUD package. It occurs because the color.blade.php template inverts the escaped and unescaped rendering logic for color columns. By default, color values are rendered unescaped, allowing attackers who can store unsanitized content in a color column to inject malicious JavaScript. When other users, including administrators, view the list page, the injected script executes in their browser.

Detection Guidance

Check if your Backpack/CRUD version is between 6.0.0-6.8.13 or 7.0.0-7.0.37. Inspect the color.blade.php file for incorrect Blade templating syntax where {{ }} and {!! !!} are swapped in conditional branches. Look for unsanitized color values stored in the database that could contain script tags.

Impact Analysis

If you are an administrator or user with access to the application, this vulnerability could allow an attacker to execute arbitrary JavaScript in your browser session. This could lead to session hijacking, unauthorized actions on your behalf, or theft of sensitive data. The impact depends on the privileges of the affected user account.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate GDPR's data protection principles or HIPAA's security requirements. Organizations using affected versions of the package may face compliance risks if user data is compromised through XSS attacks.

Mitigation Strategies

Upgrade Backpack/CRUD to versions 6.8.14 or 7.0.38 or later. If upgrading is not possible, implement strict input validation for color fields at the model layer to reject any values containing HTML or JavaScript. Review all stored color values for suspicious content and sanitize them before display.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-54181. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart