GHSA-mmg4-322v-6jvc: XSS

Published Aug 20, 2026
·
Updated

Summary

The Blade template for the color column type (src/resources/views/crud/columns/color.blade.php) has its escaped/unescaped rendering branches inverted relative to every other column template in the library. Because $column['escaped'] defaults to true, values stored in color columns are rendered unescaped by default, enabling Stored XSS if column values are not validated before storage.

Details

All other column templates in src/resources/views/crud/columns/ follow the convention: - $column['escaped'] == true → {{ $column['text'] }} (HTML-escaped) - $column['escaped'] == false → {!! $column['text'] !!} (raw)

The color template has these branches swapped. An attacker who can write an arbitrary string to a color-typed column can inject JavaScript that executes in the browser of any user who views the list — including administrators — with access to their session cookies and CSRF tokens.

Impact

Stored XSS with scope change (attacker context runs in victim's browser). Highest-risk target is an administrator viewing the list view. Exploitability requires the ability to write an unsanitized value into a color-typed column.

Patches

Fixed in 6.8.14 and 7.0.38 by correcting the branch order in color.blade.php. See PR #5992.

Workarounds

Validate stored color values against a strict CSS color grammar (e.g. /^#[0-9a-fA-F]{3,6}$/) at the model layer before data reaches the view.

Credits

Reported by Vishal Shukla (@shukla304) via sechub.dev.

Affected Software

2 affected componentsFixes available
composer/backpack/crud>=7.0.0<7.0.38
7.0.38
composer/backpack/crud>=6.0.0<6.8.14
6.8.14

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade composer/backpack/crud to a version that resolves this vulnerability.

    Fixed in 7.0.38
  2. Upgrade

    Upgrade composer/backpack/crud to a version that resolves this vulnerability.

    Fixed in 6.8.14
  3. Upgrade

    Upgrade (Laravel/Blade CRUD) color column template: src/resources/views/crud/columns/color.blade.php to a version that resolves this vulnerability.

    Fixed in 6.8.14
  4. Upgrade

    Upgrade (Laravel/Blade CRUD) color column template: src/resources/views/crud/columns/color.blade.php to a version that resolves this vulnerability.

    Fixed in 7.0.38
  5. Configuration

    Validate stored values for the color-typed column against a strict CSS color grammar (e.g., /^#[0-9a-fA-F]{3,6}$/) at the model layer before data reaches the Blade view, to prevent stored XSS when the color column is rendered unescaped.

    Model validation for color-typed column strict CSS color grammar validation = /^#[0-9a-fA-F]{3,6}$/

Event History

Aug 20, 2026
Advisory Published
via GitHub·06:38 PM
Data Sourced
via GitHub·06:38 PM
DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

1

Are color columns affected in the default configuration?

Yes. The escaped setting defaults to true, but the color column template renders values unescaped when that default is used. This differs from the behavior of other column templates.

2

Who can exploit this issue, and who is at greatest risk?

An attacker must be able to store an arbitrary, unsanitized string in a color-typed column. Any user who views the affected list can execute the stored payload, with administrators being the highest-risk victims because their browser session cookies and CSRF tokens may be exposed.

3

What can be done before upgrading?

Validate and sanitize all values written to color-typed columns so they cannot contain executable HTML or JavaScript. Do not rely on the color column's default escaped setting to protect list-view output.

4

Which releases contain fixes?

The advisory references fixed releases 6.8.14 and 7.0.38. Upgrade to the applicable fixed release for your deployed version line.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203