GHSA-mmg4-322v-6jvc: XSS
Summary
The Blade template for the color column type (src/resources/views/crud/columns/color.blade.php) has its escaped/unescaped rendering branches inverted relative to every other column template in the library. Because $column['escaped'] defaults to true, values stored in color columns are rendered unescaped by default, enabling Stored XSS if column values are not validated before storage.
Details
All other column templates in src/resources/views/crud/columns/ follow the convention: - $column['escaped'] == true → {{ $column['text'] }} (HTML-escaped) - $column['escaped'] == false → {!! $column['text'] !!} (raw)
The color template has these branches swapped. An attacker who can write an arbitrary string to a color-typed column can inject JavaScript that executes in the browser of any user who views the list — including administrators — with access to their session cookies and CSRF tokens.
Impact
Stored XSS with scope change (attacker context runs in victim's browser). Highest-risk target is an administrator viewing the list view. Exploitability requires the ability to write an unsanitized value into a color-typed column.
Patches
Fixed in 6.8.14 and 7.0.38 by correcting the branch order in color.blade.php. See PR #5992.
Workarounds
Validate stored color values against a strict CSS color grammar (e.g. /^#[0-9a-fA-F]{3,6}$/) at the model layer before data reaches the view.
Credits
Reported by Vishal Shukla (@shukla304) via sechub.dev.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/backpack/crudto a version that resolves this vulnerability.Fixed in 7.0.38 - Upgrade
Upgrade
composer/backpack/crudto a version that resolves this vulnerability.Fixed in 6.8.14 - Upgrade
Upgrade
(Laravel/Blade CRUD) color column template: src/resources/views/crud/columns/color.blade.phpto a version that resolves this vulnerability.Fixed in 6.8.14 - Upgrade
Upgrade
(Laravel/Blade CRUD) color column template: src/resources/views/crud/columns/color.blade.phpto a version that resolves this vulnerability.Fixed in 7.0.38 - Configuration
Validate stored values for the color-typed column against a strict CSS color grammar (e.g., /^#[0-9a-fA-F]{3,6}$/) at the model layer before data reaches the Blade view, to prevent stored XSS when the color column is rendered unescaped.
Model validation for color-typed column strict CSS color grammar validation = /^#[0-9a-fA-F]{3,6}$/
Event History
Frequently Asked Questions
Are color columns affected in the default configuration?
Yes. The escaped setting defaults to true, but the color column template renders values unescaped when that default is used. This differs from the behavior of other column templates.
Who can exploit this issue, and who is at greatest risk?
An attacker must be able to store an arbitrary, unsanitized string in a color-typed column. Any user who views the affected list can execute the stored payload, with administrators being the highest-risk victims because their browser session cookies and CSRF tokens may be exposed.
What can be done before upgrading?
Validate and sanitize all values written to color-typed columns so they cannot contain executable HTML or JavaScript. Do not rely on the color column's default escaped setting to protect list-view output.
Which releases contain fixes?
The advisory references fixed releases 6.8.14 and 7.0.38. Upgrade to the applicable fixed release for your deployed version line.