Is CVE-2026-5370 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-5370 being exploited in the wild.

How severe is CVE-2026-5370?

Low severity, with a CVSS score of 3.5, published 2 April 2026.

Which products and versions are affected?

krayin/laravel-crm (Packagist) ECOSYSTEM:introduced=0,last_affected=2.2.0.

Is there a fix for CVE-2026-5370?

A patch was published on 2026-03-01: Fix submitted via pull request 2466 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-5370 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-5370?

Check whether you run krayin/laravel-crm (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-5370: Krayin laravel-crm stored XSS in Activities and Notes modules

CVE-2026-5370 · Severity: low · CVSS 3.5 · Published 2026-04-02

Krayin laravel-crm, an open-source customer relationship management platform, contains a security flaw in its Activities and Notes modules. An authenticated user can save malicious scripts within notes or activity comments that will execute in the browser of other users, such as administrators, when they view the record. This could lead to unauthorized actions being performed on behalf of the victim or the theft of sensitive session information.

Technologies: krayin/laravel-crm (Packagist). Vendors: Packagist.

Quick answers

Is CVE-2026-5370 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-5370 being exploited in the wild.
How severe is CVE-2026-5370?: Low severity, with a CVSS score of 3.5, published 2 April 2026.
Which products and versions are affected?: krayin/laravel-crm (Packagist) ECOSYSTEM:introduced=0,last_affected=2.2.0.
Is there a fix for CVE-2026-5370?: A patch was published on 2026-03-01: Fix submitted via pull request 2466 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-5370 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-5370?: Check whether you run krayin/laravel-crm (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stored cross-site scripting (XSS) vulnerability exists in Krayin laravel-crm versions up to 2.2. The root cause is the unsafe rendering of user-controlled input in activity comments and notes using Vue.js directives like v-html and v-safe-html instead of proper escaping. An authenticated attacker can inject malicious JavaScript into the 'Notes' field within the Contacts or Persons modules. When another user views the affected record, the payload executes in their browser context. A patch (commit 73ed28d) has been identified which replaces unsafe rendering with escaped Vue interpolation.

Affected products

Krayin laravel-crm up to 2.2

Identifiers

CVE-2026-5370
GHSA-9m2v-hc5g-5jpv

Timeline

2026-03-01: patched: Fix submitted via pull request 2466
2026-04-02: disclosed: Initial disclosure date
2026-04-02: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.