CVE-2026-102279: Laravel Framework DOM-Based XSS Vulnerability

CVE-2026-102279 Overview

CVE-2026-102279 is a DOM-based cross-site scripting (XSS) vulnerability in the Laravel PHP framework's exception debug page renderer. When APP_DEBUG=true is enabled, attacker-controlled input is passed to a Tippy.js tooltip configured with allowHTML: true, allowing script execution when a user hovers over the tooltip element. The flaw is tracked as [CWE-80] (Improper Neutralization of Script-Related HTML Tags). It affects Laravel versions prior to 12.69.0 and 13.30.0, and is patched in those releases.

Critical Impact
Exploitation requires debug mode to be enabled and user interaction (hover), limiting real-world impact primarily to development and misconfigured production environments.

Affected Products

Laravel framework versions prior to 12.69.0
Laravel framework versions prior to 13.30.0
Applications running with APP_DEBUG=true exposed to untrusted input

Discovery Timeline

2026-09-28 - CVE-2026-102279 published to NVD
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-102279

Vulnerability Analysis

Laravel renders a detailed exception page when APP_DEBUG=true is set in the application environment. The renderer uses Tippy.js to display source-code tooltips for stack frames and related metadata. The tooltip instance was initialized globally with allowHTML: true, which instructs Tippy.js to interpret tooltip content as raw HTML rather than plain text.

When an exception message, stack trace, or source snippet includes attacker-influenced input, that data is written into the data-tippy-content attribute. Hovering the element causes Tippy.js to inject the HTML into the DOM, executing any embedded <script> tags or event handlers.

Root Cause

The root cause is an insecure default configuration in the exception renderer's client-side script. The single Tippy.js initializer applied allowHTML: true to every tooltip on the page, including tooltips whose content originated from application data that may reflect user input. See the GitHub Security Advisory GHSA-jh5r-qr3c-85q8 for the vendor's analysis.

Attack Vector

An attacker crafts input (for example, a URL segment, header, or request parameter) that triggers an exception whose rendered debug output contains an HTML payload. When a developer or operator views the debug page and hovers the affected element, the payload executes in the browser session. Exploitation requires debug mode to be enabled and user interaction.

php

// Patch: src/Illuminate/Foundation/resources/exceptions/renderer/components/formatted-source.blade.php
     language="php"
     truncate
     class="text-xs min-w-0"
-    data-tippy-content="{{ $source }}"
+    data-tippy-html-content="{{ $source }}"
 />

Source: GitHub Commit b495ca2

javascript

// Patch: src/Illuminate/Foundation/resources/exceptions/renderer/scripts.js
 import darkPlus from '@shikijs/themes/dark-plus';
 import lightPlus from '@shikijs/themes/light-plus';

-tippy('[data-tippy-content]', {
+const tippyOptions = {
     arrow: false,
-    allowHTML: true,
     animation: 'shift-away',
     delay: [300, 0],
     duration: 200,
     theme: 'laravel',
+};
+
+tippy('[data-tippy-content]', {
+    ...tippyOptions,
+    allowHTML: false,
+});
+
+tippy('[data-tippy-html-content]', {
+    ...tippyOptions,
+    allowHTML: true,
 });

Source: GitHub Commit b495ca2. The fix splits tooltip initialization into two selectors: plain-text tooltips (data-tippy-content) default to allowHTML: false, while HTML tooltips must opt in with the new data-tippy-html-content attribute.

Detection Methods for CVE-2026-102279

Indicators of Compromise

Anomalous HTTP requests containing HTML or JavaScript payloads in parameters likely to trigger framework exceptions (invalid route parameters, malformed JSON, SQL syntax errors).
Browser console errors or unexpected script execution reported by developers viewing Laravel debug pages.
Access logs showing external clients receiving HTTP 500 responses with debug-page HTML content.

Detection Strategies

Inventory Laravel deployments and identify any environment where APP_DEBUG=true is set outside of local development.
Scan project composer.lock files for laravel/framework versions below 12.69.0 or 13.30.0.
Review web application firewall (WAF) logs for requests generating exceptions that include reflected HTML markup.

Monitoring Recommendations

Alert on any production host returning a Laravel Ignition or Whoops-style debug page in HTTP responses.
Monitor for changes to .env files, particularly modifications that flip APP_DEBUG to true.
Track hover-triggered script execution or content security policy (CSP) violation reports on internal debug pages.

How to Mitigate CVE-2026-102279

Immediate Actions Required

Set APP_DEBUG=false in all non-development environments immediately; this fully eliminates the exposed attack surface.
Upgrade laravel/framework to 12.69.0 or 13.30.0 (or later) via composer update laravel/framework.
Restrict access to any environment where debug mode remains enabled using network-layer controls or authentication.

Patch Information

The fix is available in Laravel v12.69.0 and v13.30.0. The change was introduced in Pull Request #61381 and commit b495ca2, which disables allowHTML by default on exception page tooltips.

Workarounds

Disable debug mode by setting APP_DEBUG=false in the application .env file, which prevents the vulnerable renderer from being served.
Enforce a strict Content Security Policy that disallows inline script execution on any endpoint that could serve the debug page.
Place development environments behind a VPN or IP allowlist so exception pages are never reachable by untrusted clients.

bash

# Configuration example: disable debug mode in production
# .env
APP_ENV=production
APP_DEBUG=false

# Then clear cached configuration
php artisan config:clear
php artisan config:cache

# Upgrade to a patched Laravel release
composer require laravel/framework:^12.69.0
# or
composer require laravel/framework:^13.30.0