{"id":"GHSA-mmg4-322v-6jvc","summary":"Laravel Backpack CRUD: Stored XSS in the color column — the `@if($column['escaped'])` branches are inverted","details":"## Summary\n\nThe Blade template for the `color` column type (`src/resources/views/crud/columns/color.blade.php`) has its escaped/unescaped rendering branches inverted relative to every other column template in the library. Because `$column['escaped']` defaults to `true`, values stored in color columns are rendered **unescaped by default**, enabling Stored XSS if column values are not validated before storage.\n\n## Details\n\nAll other column templates in `src/resources/views/crud/columns/` follow the convention:\n- `$column['escaped'] == true` → `{{ $column['text'] }}` (HTML-escaped)\n- `$column['escaped'] == false` → `{!! $column['text'] !!}` (raw)\n\nThe `color` template has these branches swapped. An attacker who can write an arbitrary string to a `color`-typed column can inject JavaScript that executes in the browser of any user who views the list — including administrators — with access to their session cookies and CSRF tokens.\n\n## Impact\n\nStored XSS with scope change (attacker context runs in victim's browser). Highest-risk target is an administrator viewing the list view. Exploitability requires the ability to write an unsanitized value into a `color`-typed column.\n\n## Patches\n\nFixed in **6.8.14** and **7.0.38** by correcting the branch order in `color.blade.php`. See PR #5992.\n\n## Workarounds\n\nValidate stored color values against a strict CSS color grammar (e.g. `/^#[0-9a-fA-F]{3,6}$/`) at the model layer before data reaches the view.\n\n## Credits\n\nReported by Vishal Shukla ([@shukla304](https://github.com/shukla304)) via sechub.dev.","aliases":["CVE-2026-54181"],"modified":"2026-08-20T18:56:17.323354Z","published":"2026-08-20T18:38:50Z","database_specific":{"cwe_ids":["CWE-1023","CWE-79"],"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2026-08-20T18:38:50Z","nvd_published_at":null},"references":[{"type":"WEB","url":"https://github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-mmg4-322v-6jvc"},{"type":"PACKAGE","url":"https://github.com/Laravel-Backpack/CRUD"},{"type":"WEB","url":"https://github.com/Laravel-Backpack/CRUD/releases/tag/6.8.14"},{"type":"WEB","url":"https://github.com/Laravel-Backpack/CRUD/releases/tag/7.0.38"}],"affected":[{"package":{"name":"backpack/crud","ecosystem":"Packagist","purl":"pkg:composer/backpack/crud"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.8.14"}]}],"versions":["6.0.0","6.0.1","6.0.2","6.0.3","6.0.4","6.0.5","6.0.6","6.0.7","6.1.0","6.1.1","6.1.10","6.1.11","6.1.12","6.1.13","6.1.14","6.1.15","6.1.16","6.1.2","6.1.3","6.1.4","6.1.5","6.1.6","6.1.7","6.1.8","6.1.9","6.2.0","6.2.1","6.2.2","6.2.3","6.2.4","6.3.0","6.3.1","6.3.2","6.4.0","6.4.1","6.4.2","6.5.0","6.5.1","6.5.2","6.5.3","6.5.4","6.5.5","6.6.0","6.6.1","6.6.2","6.6.3","6.6.4","6.6.5","6.6.6","6.7.0","6.7.1","6.7.10","6.7.11","6.7.12","6.7.13","6.7.14","6.7.15","6.7.16","6.7.17","6.7.18","6.7.19","6.7.2","6.7.20","6.7.21","6.7.22","6.7.23","6.7.24","6.7.25","6.7.26","6.7.27","6.7.28","6.7.29","6.7.3","6.7.30","6.7.31","6.7.32","6.7.33","6.7.34","6.7.35","6.7.36","6.7.37","6.7.38","6.7.39","6.7.4","6.7.40","6.7.41","6.7.42","6.7.43","6.7.44","6.7.45","6.7.46","6.7.47","6.7.48","6.7.49","6.7.5","6.7.50","6.7.51","6.7.52","6.7.53","6.7.54","6.7.55","6.7.56","6.7.6","6.7.7","6.7.8","6.7.9","6.8.0","6.8.1","6.8.10","6.8.11","6.8.12","6.8.13","6.8.2","6.8.3","6.8.4","6.8.5","6.8.6","6.8.7","6.8.8","6.8.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-mmg4-322v-6jvc/GHSA-mmg4-322v-6jvc.json"}},{"package":{"name":"backpack/crud","ecosystem":"Packagist","purl":"pkg:composer/backpack/crud"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.0.38"}]}],"versions":["7.0.0","7.0.1","7.0.10","7.0.11","7.0.12","7.0.13","7.0.14","7.0.15","7.0.16","7.0.17","7.0.18","7.0.19","7.0.2","7.0.20","7.0.21","7.0.22","7.0.23","7.0.24","7.0.25","7.0.26","7.0.27","7.0.28","7.0.29","7.0.3","7.0.30","7.0.31","7.0.32","7.0.33","7.0.34","7.0.35","7.0.36","7.0.37","7.0.4","7.0.5","7.0.6","7.0.7","7.0.8","7.0.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-mmg4-322v-6jvc/GHSA-mmg4-322v-6jvc.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"}]}