Vulnerability advisory

CVE-2024-13919

Laravel Reflected XSS via Route Parameter in Debug-Mode Error Page

Published Mar 10, 2025Updated Oct 28, 2026OSV record ↗

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/laravel/framework ↗
2fd3a257bbccfbdceb1ccc55361c001561a53f84 to before 153254cac5210eba8e14709f5eb7450e73fa690e	`153254cac5210eba8e14709f5eb7450e73fa690e`
Also listed as affected (44) `v11.35.1` `v11.35.0` `v11.34.2` `v11.34.1` `v11.34.0` `v11.33.2` `v11.33.1` `v11.33.0` `v11.32.0` `v11.31.0` `v11.30.0` `v11.29.0` `v11.28.1` `v11.28.0` `v11.27.2` `v11.27.1` `v11.27.0` `v11.26.0` `v11.25.0` `v11.24.1` `v11.24.0` `v11.23.4` `v11.23.3` `v11.23.2` `v11.23.1` `v11.23.0` `v11.22.0` `v11.21.0` `v11.20.0` `v11.19.0` `v11.18.1` `v11.18.0` `v11.17.0` `v11.16.0` `v11.15.0` `v11.14.0` `v11.13.0` `v11.12.0` `v11.11.1` `v11.11.0` `v11.10.0` `v11.9.2` `v11.9.1` `v11.9.0`

Description

The Laravel framework versions between 11.9.0 and 11.35.1 are susceptible to reflected cross-site scripting due to an improper encoding of route parameters in the debug-mode error page.

CVE-2024-13919

Affected versions

Repository

Description

References