laravel/framework vulnerabilities
The Laravel Framework.
- Registry
- Composer
- Latest
- 13.38.0
- License
- MIT
26 known advisories
The latest version, 13.38.0, is not affected by any of them. Projects on older versions may be.
composer require laravel/framework:^13.38.0Security advisories for laravel/framework
Laravel: XSS in Debug Page Information
- Affected
- <12.69.0 · >=13.0.0 <13.30.0
- Fixed in
- 12.69.0, 13.30.0
Laravel Framework: Temporary Signed URL Path Confusion
- Affected
- >=13.0.0 <13.12.0 · <12.61.1
- Fixed in
- 12.61.1, 13.12.0
Laravel Framework: CRLF injection in default email rule
- Affected
- >=13.0.0 <13.10.0 · <12.60.0
- Fixed in
- 12.60.0, 13.10.0
Laravel framework susceptible to reflected cross-site scripting
- Affected
- >=11.9.0 <11.36.0
- Fixed in
- 11.36.0
Laravel framework susceptible to reflected cross-site scripting
- Affected
- >=11.9.0 <11.36.0
- Fixed in
- 11.36.0
Laravel has a File Validation Bypass
- Affected
- >=12.0.0 <12.1.1 · >=11.0.0 <11.44.1 · <10.48.29
- Fixed in
- 10.48.29, 11.44.1, 12.1.1
Laravel environment manipulation via query string
- Affected
- <6.20.45 · >=7.0.0 <7.30.7 · >=8.0.0 <8.83.28 · >=9.0.0 <9.52.17 · >=10.0.0 <10.48.23 · >=11.0.0 <11.31.0
- Fixed in
- 6.20.45, 7.30.7, 8.83.28, 9.52.17, 10.48.23, 11.31.0
laravel framework SQL Injection via limit and offset functions
- Affected
- >=6.0.0 <6.20.26 · >=7.0.0 <7.30.5 · >=8.0.0 <8.40.0
- Fixed in
- 6.20.26, 7.30.5, 8.40.0
laravel framework Unexpected database bindings via requests
- Affected
- >=6.0.0 <6.20.14 · >=7.0.0 <7.30.4 · >=8.0.0 <8.24.0
- Fixed in
- 6.20.14, 7.30.4, 8.24.0
Laravel Guard bypass in Eloquent models
- Affected
- >=5.5.0 <=5.5.49 · >=6.0.0 <6.18.34 · >=7.0.0 <7.23.2
- Fixed in
- 6.18.34, 7.23.2
Laravel RCE vulnerability in "cookie" session driver
- Affected
- >=4.1.0 <6.18.31 · >=7.0.0 <7.22.4
- Fixed in
- 6.18.31, 7.22.4
Laravel Cross-site Scripting (XSS) vulnerability in blade templating
- Affected
- >=7.0.0 <7.1.2
- Fixed in
- 7.1.2
Laravel Cookie serialization vulnerability
- Affected
- >=5.5.0 <5.6.30
- Fixed in
- 5.6.30
Laravel Encrypter Component Potential Decryption Failure Leading to Unintended Behavior
- Affected
- <5.5.40 · >=5.6.0 <5.6.15
- Fixed in
- 5.5.40, 5.6.15
Laravel Hijacked authentication cookies vulnerability
- Affected
- >=4.0.0 <4.1.26
- Fixed in
- 4.1.26
Laravel Risk of mass-assignment vulnerabilities
- Affected
- >=4.0.0 <4.1.29
- Fixed in
- 4.1.29
Laravel does not properly constrain the host portion of a password-reset URL
- Affected
- >=5.3.0 <=5.3.31 · >=5.4.0 <5.4.22
- Fixed in
- 5.4.22
Laravel Sensitive Data Exposure
- Affected
- <5.5.10
- Fixed in
- 5.5.10
Laravel Framework Deserialization Vulnerability
- Affected
- >=5.7.0 <6.20.44
- Fixed in
- 6.20.44
Laravel Framework RCE Vulnerability
- Affected
- <=5.5.40 · >=5.6.0 <5.6.30
- Fixed in
- 5.6.30
OS Command Injection in Laravel Framework
- Affected
- <5.8.17
- Fixed in
- 5.8.17
Laravel Framework XSS in Blade templating engine
- Affected
- <6.20.42 · >=7.0.0 <7.30.6 · >=8.0.0 <8.75.0
- Fixed in
- 6.20.42, 7.30.6, 8.75.0
Improper Input Validation in Laravel
- Affected
- <6.18.35 · >=7.0.0 <7.24.0
- Fixed in
- 6.18.35, 7.24.0
SQL Server LIMIT / OFFSET SQL Injection in laravel/framework and illuminate/database
- Affected
- >=8.0.0 <8.40.0 · <6.20.26
- Fixed in
- 6.20.26, 8.40.0
Unexpected database bindings
- Affected
- <6.20.14 · >=7.0.0 <7.30.4 · >=8.0.0 <8.24.0
- Fixed in
- 6.20.14, 7.30.4, 8.24.0
Query Binding Exploitation
- Affected
- >=8.0.0 <8.22.1 · >=6.0.0 <6.20.11 · >=7.0.0 <7.30.2
- Fixed in
- 6.20.11, 7.30.2, 8.22.1
Which of your client projects still run an old laravel/framework?
NPMscan reads the composer.lock in every GitHub repo you pick and checks each installed version against these advisories, including the packages your packages pull in. Each finding comes with the command that fixes it.
Other Composer packages
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily. Package details from the Composer registry.