GHSA-vr95-p7q6-8m9q
Laravel Cross-site Scripting (XSS) vulnerability in blade templating
Laravel 7.1.2 addresses a possible XSS related attack vector in the Laravel 7.x Blade Component tag attributes when users are allowed to dictate the value of attributes. All Laravel 7.x users are encouraged to upgrade as soon as possible.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
What each source reports
GitHub Advisories Score used
Laravel Cross-site Scripting (XSS) vulnerability in blade templating
Laravel 7.1.2 addresses a possible XSS related attack vector in the Laravel 7.x Blade Component tag attributes when users are allowed to dictate the value of attributes. All Laravel 7.x users are encouraged to upgrade as soon as possible.
- Record
GHSA-vr95-p7q6-8m9q- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
Laravel Cross-site Scripting (XSS) vulnerability in blade templating
Laravel 7.1.2 addresses a possible XSS related attack vector in the Laravel 7.x Blade Component tag attributes when users are allowed to dictate the value of attributes. All Laravel 7.x users are encouraged to upgrade as soon as possible.
- Record
GHSA-vr95-p7q6-8m9q- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
laravel/frameworkPackagist | 7.0.0 up to 7.1.2 | 7.1.2 |
laravel/frameworkPackagist | 7.0.0 up to 7.1.2, plus listed versions v7.0.0v7.0.1v7.0.2v7.0.3v7.0.4 Show 6 moreShow lessv7.0.5v7.0.6v7.0.7v7.0.8v7.1.0v7.1.1 | 7.1.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-vr95-p7q6-8m9q is a medium vulnerability (CVSS 4.3) in laravel/framework, published May 15, 2024. No source lists public exploit code. Fixed in laravel/framework 7.1.2.