Laravel Cross-site Scripting (XSS) vulnerability in blade templating

2024-05-1522:16:06

Google

osv.dev

laravel

xss

vulnerability

fix

blade

component

upgrade

6.1 Medium

AI Score

Confidence

High

JSON

Laravel 7.1.2 addresses a possible XSS related attack vector in the Laravel 7.x Blade Component tag attributes when users are allowed to dictate the value of attributes. All Laravel 7.x users are encouraged to upgrade as soon as possible.

CPENameOperatorVersion
laravel/frameworkeq7.0.2
laravel/frameworkeq7.0.4
laravel/frameworkeq7.1.0
laravel/frameworkeq7.1.1
laravel/frameworkeq7.0.3
laravel/frameworkeq7.0.6
laravel/frameworkeq7.0.5
laravel/frameworkeq7.0.7
laravel/frameworkeq7.0.1
laravel/frameworkeq7.0.0

Name	Operator	Version
laravel/framework	eq	7.0.2
laravel/framework	eq	7.0.4
laravel/framework	eq	7.1.0
laravel/framework	eq	7.1.1
laravel/framework	eq	7.0.3
laravel/framework	eq	7.0.6
laravel/framework	eq	7.0.5
laravel/framework	eq	7.0.7
laravel/framework	eq	7.0.1
laravel/framework	eq	7.0.0

Rows per page:

1-10 of 111

References

blog.laravel.com/security-laravel-712-released

github.com/FriendsOfPHP/security-advisories/blob/master/laravel/framework/2020-03-13-1.yaml

github.com/laravel/framework

github.com/laravel/framework/pull/31945

github.com/laravel/framework/releases/tag/v7.1.2

6.1 Medium

AI Score

Confidence

High

JSON