CVE-2026-5370: Krayin Laravel-CRM XSS Vulnerability

CVE-2026-5370 Overview

A Cross-Site Scripting (XSS) vulnerability has been identified in Krayin Laravel CRM versions up to 2.2. The vulnerability affects the composeMail function within the Activities Module and Notes Module components. This flaw allows attackers to inject malicious scripts through improper input handling, enabling remote exploitation via network access.

Critical Impact

Attackers can inject malicious scripts into CRM pages viewed by other users, potentially leading to session hijacking, credential theft, or unauthorized actions within the CRM system.

Affected Products

• Krayin Laravel CRM up to version 2.2
• Activities Module (packages/Webkul/Admin/tests/e2e-pw/tests/mail/inbox.spec.ts)
• Notes Module

Discovery Timeline

• 2026-04-02 - CVE-2026-5370 published to NVD
• 2026-04-02 - Last updated in NVD database

Technical Details for CVE-2026-5370

Vulnerability Analysis

This vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly known as Cross-Site Scripting. The flaw exists in the mail composition functionality of Krayin Laravel CRM's administrative interface. When users compose emails through the Activities or Notes modules, input data is not properly sanitized before being rendered in the browser context.

The vulnerability requires an authenticated user with low privileges and some user interaction to exploit successfully. Once triggered, the injected scripts execute in the victim's browser session within the context of the CRM application, potentially allowing attackers to perform actions on behalf of legitimate users.

Root Cause

The root cause of this vulnerability lies in the insufficient input validation and output encoding within the composeMail function. User-supplied data passed to this function is not properly sanitized or escaped before being rendered in HTML output. This allows specially crafted input containing JavaScript code to be interpreted and executed by the victim's browser rather than being displayed as plain text.

Attack Vector

The attack vector is network-based, meaning an attacker can exploit this vulnerability remotely without requiring local system access. The attack requires the attacker to have low-level privileges (authenticated access) and necessitates user interaction for successful exploitation. An attacker would craft a malicious payload containing JavaScript code and inject it through the vulnerable mail composition interface, which would then execute when viewed by other users.

The vulnerability is documented in the GitHub Issue Discussion with additional details available in the associated Pull Request that addresses the issue.

Detection Methods for CVE-2026-5370

Indicators of Compromise

• Unusual JavaScript code or HTML tags present in mail content, activity notes, or database fields
• Unexpected outbound connections from user browsers to external domains when viewing CRM pages
• Reports of session hijacking or unauthorized actions from legitimate users
• Abnormal patterns in web server logs showing encoded script payloads in request parameters

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block common XSS payload patterns in request bodies
• Deploy Content Security Policy (CSP) headers to restrict inline script execution and report violations
• Monitor application logs for suspicious input patterns containing <script>, javascript:, or encoded variants
• Conduct regular security audits of user-generated content stored in the CRM database

Monitoring Recommendations

• Enable CSP violation reporting to identify attempted XSS attacks in real-time
• Set up alerts for unusual browser behavior patterns across CRM user sessions
• Review web application firewall logs for blocked XSS attempts targeting mail composition endpoints
• Monitor for anomalous database entries containing HTML or JavaScript content

How to Mitigate CVE-2026-5370

Immediate Actions Required

• Update Krayin Laravel CRM to a patched version that includes commit 73ed28d466bf14787fdb86a120c656a4af270153
• Review existing data in Activities and Notes modules for any malicious scripts that may have been injected
• Implement Content Security Policy headers to reduce the impact of any successful XSS attempts
• Educate users about the risks of interacting with suspicious content within the CRM

Patch Information

The vulnerability has been addressed in the official GitHub commit. Organizations running affected versions should apply this patch immediately by updating to a version that includes the fix. The patch identifier is 73ed28d466bf14787fdb86a120c656a4af270153.

Additional technical details and discussion can be found in the Krayin Laravel CRM repository and the VulDB entry.

Workarounds

• Deploy a Web Application Firewall with XSS protection rules to filter malicious input before it reaches the application
• Implement strict Content Security Policy headers to prevent inline script execution
• Restrict access to the Activities and Notes modules to trusted users until the patch can be applied
• Consider disabling the mail composition feature temporarily if it is not critical to operations

# Example Content Security Policy header configuration for Apache
# Add to .htaccess or Apache configuration
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; object-src 'none';"

# For Nginx, add to server block
# add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; object-src 'none';";