CVE-2025-26159 Laravel Starter Cross Site Scripting (XSS)
Attackers with tag creation privileges can inject malicious JavaScript via the tag name field in Laravel Starter.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-26159?
CVE-2025-26159 is a medium-severity cross-site scripting vulnerability in n/a, published on 22 Apr 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Laravel Starter 11.11.0 is vulnerable to Cross Site Scripting (XSS) in the tags feature. Any user with the ability of create or modify tags can inject malicious JavaScript code in the name field.
Weakness: CWE-79
Which versions are affected by CVE-2025-26159?
2 open source packages ship an affected version, including nasirkhan/laravel-starter.
| Package | Affected | Fixed in |
|---|---|---|
nasirkhan/laravel-starter Packagist | All versions | 11.11.0 |
nasirkhan/laravel-starter Packagist | All versions | 11.11.0 |
How do I fix CVE-2025-26159?
Upgrade nasirkhan/laravel-starter to 11.11.0 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2025-26159 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-26159 exists.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-fpx3-h2pc-88vf.