Executive brief
Krayin laravel-crm, an open-source customer relationship management platform, contains a security flaw in its Activities and Notes modules. An authenticated user can save malicious scripts within notes or activity comments that will execute in the browser of other users, such as administrators, when they view the record. This could lead to unauthorized actions being performed on behalf of the victim or the theft of sensitive session information.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in Krayin laravel-crm versions up to 2.2. The root cause is the unsafe rendering of user-controlled input in activity comments and notes using Vue.js directives like v-html and v-safe-html instead of proper escaping. An authenticated attacker can inject malicious JavaScript into the 'Notes' field within the Contacts or Persons modules. When another user views the affected record, the payload executes in their browser context. A patch (commit 73ed28d) has been identified which replaces unsafe rendering with escaped Vue interpolation.
Affected products
- Krayin laravel-crm up to 2.2
Timeline
- 2026-03-01: patched: Fix submitted via pull request 2466
- 2026-04-02: disclosed: Initial disclosure date
- 2026-04-02: advisory: NVD publication date
References
- https://github.com/krayin/laravel-crm/
- https://github.com/krayin/laravel-crm/commit/73ed28d466bf14787fdb86a120c656a4af270153
- https://github.com/krayin/laravel-crm/issues/2419
- https://github.com/krayin/laravel-crm/pull/2466
- https://vuldb.com/submit/781666
- https://vuldb.com/vuln/354756
- https://vuldb.com/vuln/354756/cti