CVE-2026-54181

The Blade template for the color column type (src/resources/views/crud/columns/color.blade.php) has its escaped/unescaped rendering branches inverted relative to every other column template in the library. Because $column['escaped'] defaults to true, values stored in color columns are rendered unescaped by default, enabling Stored XSS if column values are not validated before storage.

All other column templates in src/resources/views/crud/columns/ follow the convention:

The color template has these branches swapped. An attacker who can write an arbitrary string to a color-typed column can inject JavaScript that executes in the browser of any user who views the list — including administrators — with access to their session cookies and CSRF tokens.

Stored XSS with scope change (attacker context runs in victim's browser). Highest-risk target is an administrator viewing the list view. Exploitability requires the ability to write an unsanitized value into a color-typed column.

Fixed in 6.8.14 and 7.0.38 by correcting the branch order in color.blade.php. See PR #5992.

Validate stored color values against a strict CSS color grammar (e.g. /^#[0-9a-fA-F]{3,6}$/) at the model layer before data reaches the view.

Reported by Vishal Shukla (@shukla304) via sechub.dev.