CVE-2024-13919: Laravel Framework XSS Vulnerability

CVE-2024-13919 Overview

CVE-2024-13919 is a reflected cross-site scripting (XSS) vulnerability in the Laravel framework. Versions 11.9.0 through 11.35.1 improperly encode route parameters when rendering the debug-mode error page. An attacker can craft a URL containing malicious script content that executes in the victim's browser when the debug error page is displayed. The flaw is classified as [CWE-79] and affects Laravel applications running with debug mode enabled. Laravel addressed the issue in release v11.36.0.

Critical Impact
Attackers can execute arbitrary JavaScript in a victim's browser session, enabling session hijacking, credential theft, and unauthorized actions against applications running Laravel with debug mode enabled.

Affected Products

Laravel Framework 11.9.0
Laravel Framework versions 11.9.x through 11.35.x
Laravel Framework 11.35.1

Discovery Timeline

2025-03-10 - CVE-2024-13919 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-13919

Vulnerability Analysis

The vulnerability resides in Laravel's debug-mode error page rendering path. When a routing error occurs, the framework reflects route parameter values back into the generated HTML error page without proper output encoding. Because the debug page includes user-controllable path segments, an attacker can inject HTML or JavaScript through crafted URL components.

Exploitation requires user interaction. The victim must click or be redirected to a malicious URL targeting a Laravel application with APP_DEBUG=true. The injected script executes in the context of the vulnerable application's origin, giving attackers access to cookies, DOM data, and any authenticated session state accessible from the browser.

The issue is scored under [CWE-79] Improper Neutralization of Input During Web Page Generation. The scope-changed CVSS metrics reflect that injected script can affect resources beyond the vulnerable component, such as other browser-managed origins.

Root Cause

The root cause is missing HTML entity encoding of route parameter values before they are inserted into the debug-mode error page template. The rendering logic treats parameter strings as safe text rather than untrusted input. Laravel's pull request #53869 corrects the encoding path so that reserved HTML characters in route parameters are escaped before output.

Attack Vector

An attacker crafts a URL to a vulnerable Laravel endpoint containing a malicious payload within a route parameter. The victim is lured into clicking the link through phishing, chat, or a malicious referrer. Laravel's router fails to match the request, produces a debug error page, and reflects the unsanitized parameter into the response. The browser parses the injected markup and executes the attacker's JavaScript.

See the SBA Research Security Advisory for the detailed technical writeup and proof-of-concept context.

Detection Methods for CVE-2024-13919

Indicators of Compromise

HTTP request logs containing route parameters with <script>, onerror=, javascript:, or URL-encoded equivalents such as %3Cscript%3E.
Web server or application logs showing 404 or routing errors accompanied by unusually long or encoded URL segments.
Outbound requests from user browsers to attacker-controlled domains immediately after visits to Laravel application URLs.

Detection Strategies

Inspect access logs for requests targeting Laravel routes that contain HTML metacharacters in path segments.
Deploy web application firewall (WAF) rules that flag reflected XSS payloads within URL path components, not only query strings.
Correlate 4xx routing errors with debug-mode responses being served to external clients.

Monitoring Recommendations

Alert on any production hosts serving responses that include stack traces or the Ignition debug page.
Monitor for the APP_DEBUG=true configuration in production deployments through infrastructure-as-code scanning.
Track user-agent and referrer patterns associated with reflected XSS delivery, such as external referrers pointing to crafted Laravel URLs.

How to Mitigate CVE-2024-13919

Immediate Actions Required

Upgrade Laravel Framework to version 11.36.0 or later, which contains the fix from pull request #53869.
Set APP_DEBUG=false in all production .env files immediately, regardless of patch status.
Audit deployed environments to confirm no internet-facing Laravel instance is running with debug mode enabled.

Patch Information

Laravel resolved this vulnerability in release v11.36.0. The fix ensures route parameters are HTML-encoded before being rendered in debug-mode error pages. Application maintainers should update via composer update laravel/framework and validate the installed version is 11.36.0 or higher. Additional context is available in the Openwall OSS Security Alert.

Workarounds

Disable debug mode in production by setting APP_DEBUG=false in the environment configuration.
Restrict access to non-production environments that require debug mode through IP allow-listing or VPN gating.
Configure a strict Content Security Policy (CSP) that blocks inline script execution to reduce the impact of reflected XSS payloads.

bash

# Configuration example
# Disable debug mode in production .env
APP_ENV=production
APP_DEBUG=false

# Upgrade Laravel Framework to the patched release
composer require laravel/framework:^11.36.0
composer update laravel/framework
php artisan --version