CVE-2026-102279 (CVSS 3.1)

Description

Laravel is a web application framework. Prior to 12.69.0 and 13.30.0, Laravel exception debug pages with APP_DEBUG=true pass attacker-controlled input to a Tippy.js tooltip configured with allowHTML true, enabling DOM-based cross-site scripting when a user hovers over the tooltip. This issue is fixed in versions 12.69.0 and 13.30.0.

Is your site exposed to CVE-2026-102279?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

3.1

LOW

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

EPSS — Exploit Prediction

0.0020

Probability of exploitation

0.10%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

Weakness Type (CWE)

CWE-80 CWE-80

References

Other References

https://github.com/laravel/framework/commit/b495ca2ec4e15a977e8700328bf13e8a79f29d12 https://github.com/laravel/framework/pull/61381 https://github.com/laravel/framework/releases/tag/v12.69.0 https://github.com/laravel/framework/releases/tag/v13.30.0 https://github.com/laravel/framework/security/advisories/GHSA-jh5r-qr3c-85q8

Frequently Asked Questions

What is CVE-2026-102279? +

Laravel is a web application framework. Prior to 12.69.0 and 13.30.0, Laravel exception debug pages with APP_DEBUG=true pass attacker-controlled input to a Tippy.js tooltip configured with allowHTML true, enabling DOM-based cross-site scripting when a user hovers over the tooltip. This issue is fixed in versions 12.69.0 and 13.30.0. It has a CVSS v3.1 base score of 3.1 (LOW).

How severe is CVE-2026-102279? +

CVE-2026-102279 has a CVSS v3.1 score of 3.1 out of 10, rated LOW. This is a low-severity vulnerability with limited impact. The EPSS score is 0.0020, placing it in the 0th percentile for exploitation probability.

How do I check if I'm vulnerable to CVE-2026-102279? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-40872

mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, the admin dashboard's Autodiscover …

CVE-2026-40875

mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, the user dashboard's "Seen …

CVE-2025-71310

The GDPR cookies module for Backdrop CMS (before 1.x-1.3.5) doesn't sufficiently protect visitors from Cross Site Scripting (XSS) if a …

CVE-2026-103439

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki Wikbase extension …

CVE-2025-25299

CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. During a recent internal audit, a Cross-Site Scripting …

CVE-2025-22274

It is possible to inject HTML code into the page content using the "content" field in the "Application definition" page. …

CVE-2026-102279