Is illuminate/database 7.9 vulnerable?
Composer · 3 releases from 7.9.0 to 7.9.2 · latest illuminate/database is 13.40.0 · checked 5 Nov 2026
Yes: 3 known advisories
Yes. illuminate/database 7.9.2, the last 7.9 release, is affected by 3 known security advisories (3 high), including CVE-2020-24940, CVE-2021-21263. Upgrade to 7.30.4 or later to fix all of them.
composer require illuminate/database:^7.30.4Advisories affecting illuminate/database 7.9.2
Guard bypass in Eloquent models affecting Laravel illuminate database component
- Affected
- >=5.5.0 <=5.5.44 · >=6.0.0 <6.18.34 · >=7.0.0 <7.23.2
- Fixed in
- 6.18.34, 7.23.2
Unexpected database bindings
- Affected
- <6.20.14 · >=7.0.0 <7.30.4 · >=8.0.0 <8.24.0
- Fixed in
- 6.20.14, 7.30.4, 8.24.0
Query Binding Exploitation
- Affected
- >=7.0.0 <7.30.3 · >=8.0.0 <8.22.1 · >=6.0.0 <6.20.12
- Fixed in
- 6.20.12, 7.30.3, 8.22.1
Which of your client projects are still on illuminate/database 7.9?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact illuminate/database version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other illuminate/database versions
- illuminate/database 7.12
- illuminate/database 7.11
- illuminate/database 7.10
- illuminate/database 7.8
- illuminate/database 7.7
- illuminate/database 7.6
- illuminate/database 13.40
- illuminate/database 13.39
- illuminate/database 13.38
- illuminate/database 13.37
- illuminate/database 13.36
- illuminate/database 13.35
- All illuminate/database advisories
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the Composer registry. Refreshed daily.