Executive brief
Laravel Backpack CRUD is a popular administration panel builder for Laravel web applications. A bug in the color column display template renders user-supplied color values without HTML escaping by default, allowing an attacker who can inject a malicious value into a color column to execute arbitrary JavaScript in the browsers of anyone viewing the list—including administrators. This enables stealing session cookies, CSRF tokens, and other sensitive data.
Technical details
The vulnerability is a stored XSS (CWE-79) caused by inverted conditional logic in the color column Blade template (src/resources/views/crud/columns/color.blade.php). While all other column templates in the library follow the pattern of using {{ }} (HTML-escaped) when $column['escaped'] is true and {!! !!} (raw output) when false, the color template has these branches reversed. Because $column['escaped'] defaults to true, color values are rendered unescaped by default, enabling stored XSS. The attack requires write access to a color-typed column (low privilege requirement) and is triggered when a victim views the list (user interaction required). Scope change occurs because injected JavaScript executes in the context of the victim's session, not the attacker's. The fix corrects the branch order in color.blade.php; patched versions are 6.8.14 and 7.0.38.
Affected products
- Laravel Backpack CRUD 6.0.0 through 6.8.13; 7.0.0 through 7.0.37
Timeline
- 2026-06-15: disclosed: Published to GitHub Advisory Database
- 2026-06-15: patched: Fixed in versions 6.8.14 and 7.0.38 (PR #5992)