GHSA-mmg4-322v-6jvc

Suggest an improvement
Source
https://github.com/advisories/GHSA-mmg4-322v-6jvc
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-mmg4-322v-6jvc/GHSA-mmg4-322v-6jvc.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-mmg4-322v-6jvc
Aliases
Published
2026-08-20T18:38:50Z
Modified
2026-08-20T18:48:09Z
Severity
  • 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
Laravel Backpack CRUD: Stored XSS in the color column — the `@if($column['escaped'])` branches are inverted
Details

Summary

The Blade template for the color column type (src/resources/views/crud/columns/color.blade.php) has its escaped/unescaped rendering branches inverted relative to every other column template in the library. Because $column['escaped'] defaults to true, values stored in color columns are rendered unescaped by default, enabling Stored XSS if column values are not validated before storage.

Details

All other column templates in src/resources/views/crud/columns/ follow the convention:

  • $column['escaped'] == true → {{ $column['text'] }} (HTML-escaped)
  • $column['escaped'] == false → {!! $column['text'] !!} (raw)

The color template has these branches swapped. An attacker who can write an arbitrary string to a color-typed column can inject JavaScript that executes in the browser of any user who views the list — including administrators — with access to their session cookies and CSRF tokens.

Impact

Stored XSS with scope change (attacker context runs in victim's browser). Highest-risk target is an administrator viewing the list view. Exploitability requires the ability to write an unsanitized value into a color-typed column.

Patches

Fixed in 6.8.14 and 7.0.38 by correcting the branch order in color.blade.php. See PR #5992.

Workarounds

Validate stored color values against a strict CSS color grammar (e.g. /^#[0-9a-fA-F]{3,6}$/) at the model layer before data reaches the view.

Credits

Reported by Vishal Shukla (@shukla304) via sechub.dev.

Database specific 
{
    "cwe_ids":  [
        "CWE-1023",
        "CWE-79"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-08-20T18:38:50Z",
    "nvd_published_at":  null,
    "severity":  "MODERATE"
}
References

Affected packages

Packagist / backpack/crud

Package

Name
backpack/crud
Purl
pkg:composer/backpack/crud

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.0.0
Fixed
6.8.14

Affected versions

6.*
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.2
6.7.3
6.7.4
6.7.5
6.7.6
6.7.7
6.7.8
6.7.9
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
6.8.10
6.8.11
6.8.12
6.8.13

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-mmg4-322v-6jvc/GHSA-mmg4-322v-6jvc.json"

Packagist / backpack/crud

Package

Name
backpack/crud
Purl
pkg:composer/backpack/crud

Affected ranges

Type
ECOSYSTEM
Events
Introduced
7.0.0
Fixed
7.0.38

Affected versions

7.*
7.0.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-mmg4-322v-6jvc/GHSA-mmg4-322v-6jvc.json"