What is GHSA-jh5r-qr3c-85q8?

GHSA-jh5r-qr3c-85q8 is a security advisory published by GitHub Security Advisories with Low severity. Laravel: XSS in Debug Page Information

Which CVE IDs does GHSA-jh5r-qr3c-85q8 cover?

GHSA-jh5r-qr3c-85q8 covers the following CVE IDs: CVE-2026-102279. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-jh5r-qr3c-85q8?

GHSA-jh5r-qr3c-85q8 has a CVSS v3 base score of 3.1, published by GitHub Security Advisories.

Which products are affected by GHSA-jh5r-qr3c-85q8?

GHSA-jh5r-qr3c-85q8 affects 2 products, including: composer/laravel/framework:\u003c 12.69.0; composer/laravel/framework:\u003e= 13.0.0, \u003c 13.30.0.

GHSA-jh5r-qr3c-85q8LowCVSS 3.1

Laravel: XSS in Debug Page Information

Vendor

GitHub Security Advisories

Published

September 29, 2026

Last Modified

September 29, 2026

🔗 CVE IDs covered (1)

CVE-2026-102279 →

📋 Description

Impact

When APP_DEBUG=true, attacker-controlled input is passed to a Tippy.js tooltip configured with allowHTML: true, enabling DOM-based XSS during mouse hover.

Patches

#61381

🎯 Affected products2

composer/laravel/framework:< 12.69.0
composer/laravel/framework:>= 13.0.0, < 13.30.0

🔗 References (7)

https://github.com/laravel/framework/security/advisories/GHSA-jh5r-qr3c-85q8
https://nvd.nist.gov/vuln/detail/CVE-2026-102279
https://github.com/laravel/framework/pull/61381
https://github.com/laravel/framework/commit/b495ca2ec4e15a977e8700328bf13e8a79f29d12
https://github.com/laravel/framework/releases/tag/v12.69.0
https://github.com/laravel/framework/releases/tag/v13.30.0
https://github.com/advisories/GHSA-jh5r-qr3c-85q8