{"vulnerability": "cve-2026-102279", "sightings": [{"uuid": "d3062424-4f96-49c4-89e5-32bc982d2ae1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-102279", "type": "seen", "source": "https://gist.github.com/alon710/d482ad55d68c1bdf7dbfc835e6503fef", "content": "# CVE-2026-102279: CVE-2026-102279: DOM-based Cross-Site Scripting in Laravel Exception Debug Page via Tippy.js\n\n> **CVSS Score:** 3.1\n> **Published:** 2026-09-29\n> **Full Report:** https://cvereports.com/reports/CVE-2026-102279\n\n## Summary\nA DOM-based Cross-Site Scripting (XSS) vulnerability exists in the Laravel exception debug page rendering pipeline when APP_DEBUG=true is active. This flaw allows an attacker to execute arbitrary client-side JavaScript in the security context of an authenticated user's session when they hover over interactive code-trace tooltips handled by Tippy.js.\n\n## TL;DR\nA DOM-based Cross-Site Scripting (XSS) flaw inside the Laravel framework exception renderer allows remote code execution in administrative sessions. The flaw triggers when debugging mode is active and a user hovers over interactive tooltips managed by Tippy.js with allowHTML enabled.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-80\n- **Attack Vector**: Network\n- **CVSS Severity Score**: 3.1 (Low)\n- **EPSS Score**: 0.00202 (Percentile: 9.02%)\n- **Exploit Status**: Proof of Concept\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Laravel applications running versions < 12.69.0 with active debug configurations\n- Laravel applications running versions >= 13.0.0 and < 13.30.0 with active debug configurations\n- **laravel/framework**: < 12.69.0 (Fixed in: `12.69.0`)\n- **laravel/framework**: >= 13.0.0, < 13.30.0 (Fixed in: `13.30.0`)\n\n## Mitigation\n\n- Disable debugging mode by setting APP_DEBUG=false in environment configuration files across all staging and production instances.\n- Limit network exposure of administrative exception reports using IP blocklisting or intranet-only access policies.\n- Enforce content security policies (CSP) that restrict dynamic HTML rendering tools from running inline script vectors.\n\n**Remediation Steps:**\n1. Open the project's root directory and check current framework versions in composer.json.\n2. Run 'composer update laravel/framework' to obtain patched libraries.\n3. Verify the installed package version is 12.69.0, 13.30.0, or newer.\n4. Inspect configuration settings to ensure production systems use APP_DEBUG=false.\n\n## References\n\n- [GitHub Security Advisory GHSA-jh5r-qr3c-85q8](https://github.com/laravel/framework/security/advisories/GHSA-jh5r-qr3c-85q8)\n- [NVD CVE-2026-102279 Analysis](https://nvd.nist.gov/vuln/detail/CVE-2026-102279)\n- [CVE-2026-102279 Record](https://www.cve.org/CVERecord?id=CVE-2026-102279)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-102279) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-29T20:30:29.000000Z"}]}