CVE-2025-26159: XSS
Published Apr 22, 2025
·Updated
Laravel Starter 11.11.0 is vulnerable to Cross Site Scripting (XSS) in the tags feature. Any user with the ability of create or modify tags can inject malicious JavaScript code in the name field.
Affected Software
2 affected componentsFixes available
Laravel Laravel Starter
composer/nasirkhan/laravel-starter<11.11.0
11.11.0
Event History
Apr 22, 2025
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·08:15 PM
DescriptionSeverityWeakness
Advisory Published
via GitHub·09:30 PM
Frequently Asked Questions
1
What is the severity of CVE-2025-26159?
CVE-2025-26159 is classified as a medium severity Cross Site Scripting (XSS) vulnerability.
2
How do I fix CVE-2025-26159?
To fix CVE-2025-26159, upgrade Laravel Starter to a version higher than 11.11.0.
3
Who is affected by CVE-2025-26159?
Any user of Laravel Starter 11.11.0 with the ability to create or modify tags is affected by CVE-2025-26159.
4
What impact does CVE-2025-26159 have?
CVE-2025-26159 allows attackers to inject malicious JavaScript code, potentially leading to unauthorized actions or information theft.
5
Is CVE-2025-26159 a coding issue?
Yes, CVE-2025-26159 is caused by improper input validation in the tags feature of Laravel Starter.