CVE-2024-13919: Laravel Reflected XSS via Route Parameter in Debug-Mode Error Page
First published: Mon Mar 10 2025(Updated: )
The Laravel framework versions between 11.9.0 and 11.35.1 are susceptible to reflected cross-site scripting due to an improper encoding of route parameters in the debug-mode error page.
Credit: 1e3a9e0f-5156-4bf8-b8a3-cc311bfc0f4a
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Laravel Framework | >=11.9.0<=11.35.1 | |
| composer/laravel/framework | >=11.9.0<11.36.0 | 11.36.0 |
| Laravel | >=11.9.0<11.36.0 | |
| >=11.9.0<11.36.0 |
Remedy
Update to version 11.36.0 or later.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/laravel/framework/pull/53869
- https://github.com/laravel/framework/releases/tag/v11.36.0
- https://github.com/sbaresearch/advisories/tree/public/2024/SBA-ADV-20241209-02_Laravel_Reflected_XSS_via_Route_Parameter_in_Debug-Mode_Error_Page
- http://www.openwall.com/lists/oss-security/2025/03/10/4
- https://nvd.nist.gov/vuln/detail/CVE-2024-13919
- https://github.com/laravel/framework/commit/45287fb2a91c69bb1c110539b9b7341faf5aee33
- https://github.com/FriendsOfPHP/security-advisories/blob/master/laravel/framework/CVE-2024-13919.yaml
- https://github.com/advisories/GHSA-83wp-f5c3-hqqr (Advisory)
Frequently Asked Questions
What is the severity of CVE-2024-13919?
CVE-2024-13919 has been classified as critical due to its potential to allow reflected cross-site scripting attacks.
How do I fix CVE-2024-13919?
To fix CVE-2024-13919, upgrade your Laravel framework to version 11.36.0 or higher.
Which Laravel framework versions are affected by CVE-2024-13919?
CVE-2024-13919 affects Laravel framework versions from 11.9.0 to 11.35.1.
What type of vulnerability is CVE-2024-13919?
CVE-2024-13919 is a reflected cross-site scripting vulnerability.
What causes the vulnerability in CVE-2024-13919?
The vulnerability in CVE-2024-13919 is caused by improper encoding of route parameters in the debug-mode error page.
- agent/title
- agent/weakness
- agent/description
- agent/type
- agent/first-publish-date
- agent/author
- collector/oss-sec
- source/oss-sec
- alias/CVE-2024-13919
- agent/guess-ai
- agent/software-canonical-lookup
- agent/source
- agent/trending
- collector/mitre-cve
- source/MITRE
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-83wp-f5c3-hqqr
- agent/references
- agent/severity
- agent/remedy
- agent/last-modified-date
- agent/tags
- collector/github-advisory
- agent/softwarecombine
- agent/event
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup-request
- collector/nvd-api
- vendor/laravel
- canonical/laravel framework
- package-manager/composer
- canonical/laravel
- version/laravel/11.9.0