CVE-2026-102279

Name of the Vulnerable Software and Affected Versions Laravel versions prior to 12.69.0 Laravel versions prior to 13.30.0

Description Exception debug pages configured with APP DEBUG=true pass attacker-controlled input to a Tippy.js tooltip. Because the tooltip is configured with allowHTML set to true, it enables DOM-based cross-site scripting (XSS), a technique where a malicious script is executed in the victim's browser, when a user hovers over the tooltip.

Recommendations Update to version 12.69.0 or later. Update to version 13.30.0 or later.