Most recent entries from all

EUVD-2026-368260

fkie_cve-2026-54181

backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.14 and 7.0.38, src/resources/views/crud/columns/color.blade.php inverts the escaped and raw rendering branches controlled by $column['escaped'], which defaults to true, causing $column['text'] to be rendered unescaped by default. An attacker who can store an unsanitized value in a color column can execute script in the browser of a user who views the CRUD list, including an administrator, with access to the victim's session-backed application capabilities. Exploitation requires write access to the stored color value and a victim viewing the list. This issue is fixed in versions 6.8.14 and 7.0.38.

GHSA-mmg4-322v-6jvc — Laravel Backpack CRUD: Stored XSS in the color column — the `@if($column['escaped'])` branches are inverted

Affected: Packagist: backpack/crud

## Summary

The Blade template for the `color` column type (`src/resources/views/crud/columns/color.blade.php`) has its escaped/unescaped rendering branches inverted relative to every other column template in the library. Because `$column['escaped']` defaults to `true`, values stored in color columns are rendered **unescaped by default**, enabling Stored XSS if column values are not validated before storage.

## Details

All other column templates in `src/resources/views/crud/columns/` follow the convention: - `$column['escaped'] == true` → `{{ $column['text'] }}` (HTML-escaped) - `$column['escaped'] == false` → `{!! $column['text'] !!}` (raw)

The `color` template has these branches swapped. An attacker who can write an arbitrary string to a `color`-typed column can inject JavaScript that executes in the browser of any user who views the list — including administrators — with access to their session cookies and CSRF tokens.

## Impact

Stored XSS with scope change (attacker context runs in victim's browser). Highest-risk target is an administrator viewing the list view. Exploitability requires the ability to write an unsanitized value into a `color`-typed column.

## Patches

Fixed in **6.8.14** and **7.0.38** by correcting the branch order in `color.blade.php`. See PR #5992.

## Workarounds

Validate stored color values against a strict CSS color grammar (e.g. `/^#[0-9a-fA-F]{3,6}$/`) at the model layer before data reaches the view.

## Credits

Reported by Vishal Shukla (…