CVE-2025-26159: Laravel Starter Cross Site Scripting (XSS) Vulnerability
Summary
CVE-2025-26159: Laravel Starter Cross Site Scripting (XSS). Affects nasirkhan/laravel-starter versions < 11.11.0. Fixed in 11.11.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Laravel Starter is a PHP framework designed to facilitate rapid application development. It provides a robust set of tools and features for developers, including a tagging system that allows users to create and manage tags for various entities. However, the framework is vulnerable to Cross Site Scripting (XSS) attacks, particularly in the tags feature, where users can inject malicious scripts.
Vulnerability Detail
The vulnerability arises from improper handling of user input in the tags feature of Laravel Starter version 11.11.0. Any user with permission to create or modify tags can inject malicious JavaScript code into the name field. This can lead to unauthorized script execution in the context of other users' browsers, potentially compromising sensitive information or performing actions on behalf of the user without their consent. The vulnerability is classified under CWE-79, which pertains to improper neutralization of input during web page generation.
How To Fix
Minimum fixed version
11.11.0
This is the first release that contains the fix.
composer require nasirkhan/laravel-starter:11.11.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can sanitize user input before it is rendered on the page. This can be done by escaping special characters in the tag name to prevent script execution. For example, you can use PHP's htmlspecialchars function: `
htmlspecialchars($tagName, ENT_QUOTES, 'UTF-8');
` This will convert special characters to HTML entities, mitigating the risk of XSS.
Conclusion
The Laravel Starter package has a critical XSS vulnerability that allows users to inject malicious scripts through the tags feature. It is essential to update to the patched version or implement input sanitization to protect against potential attacks. Regular monitoring using tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for nasirkhan/laravel-starter →
FAQ
XSS is a security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users, potentially compromising their data and session.
Any user of Laravel Starter version 11.11.0 who has the ability to create or modify tags is at risk of this vulnerability.
You can use Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without needing to sign up.
The CVSS score for this vulnerability is 6.1, indicating a moderate level of risk.
If an immediate update is not possible, implement input sanitization as a temporary measure to mitigate the risk of XSS attacks.
