{"metadata": {"vulnerability": "CVE-2026-102279", "count": 13, "kinds": {"milestone": 4, "sighting": 1, "kev": 0, "other": 8}}, "data": [{"timestamp": "2026-09-28T20:11:16.659Z", "date_only": false, "value": "2026-09-28T20:11:16.659Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-102279", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-09-28T20:59:36.528Z", "date_only": false, "value": "2026-09-28T20:59:36.528Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-102279", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-09-28T20:59:36.528Z", "date_only": false, "value": "2026-09-28T20:59:36.528Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-102279", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-28T21:17:16Z", "date_only": false, "value": "2026-09-28T21:17:16Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-JH5R-QR3C-85Q8", "record": "GHSA-JH5R-QR3C-85Q8", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-09-28T21:17:16.710Z", "date_only": false, "value": "2026-09-28T21:17:16.710", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-102279", "record": "FKIE_CVE-2026-102279", "field": "published"}, {"timestamp": "2026-09-29T14:43:55.430Z", "date_only": false, "value": "2026-09-29T14:43:55.430439Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-102279", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-09-29T14:43:55.430Z", "date_only": false, "value": "2026-09-29T14:43:55.430439Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-102279", "record": "FKIE_CVE-2026-102279", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-09-29T14:44:03.594Z", "date_only": false, "value": "2026-09-29T14:44:03.594Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-102279", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-09-29T14:44:03.594Z", "date_only": false, "value": "2026-09-29T14:44:03.594Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-102279", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-29T18:24:25Z", "date_only": false, "value": "2026-09-29T18:24:25Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-JH5R-QR3C-85Q8", "record": "GHSA-JH5R-QR3C-85Q8", "field": "published"}, {"timestamp": "2026-09-29T18:24:25Z", "date_only": false, "value": "2026-09-29T18:24:25Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-JH5R-QR3C-85Q8", "record": "GHSA-JH5R-QR3C-85Q8", "field": "modified"}, {"timestamp": "2026-09-29T20:30:29Z", "date_only": false, "value": "2026-09-29T20:30:29.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/alon710/d482ad55d68c1bdf7dbfc835e6503fef", "record": "CVE-2026-102279", "field": "creation_timestamp", "uuid": "d3062424-4f96-49c4-89e5-32bc982d2ae1", "content": "# CVE-2026-102279: CVE-2026-102279: DOM-based Cross-Site Scripting in Laravel Exception Debug Page via Tippy.js\n\n> **CVSS Score:** 3.1\n> **Published:** 2026-09-29\n> **Full Report:** https://cvereports.com/reports/CVE-2026-102279\n\n## Summary\nA DOM-based Cross-Site Scripting (XSS) vulnerability exists in the Laravel exception debug page rendering pipeline when APP_DEBUG=true is active. This flaw allows an attacker to execute arbitrary client-side JavaScript in the security context of an authenticated user's session when they hover over interactive code-trace tooltips handled by Tippy.js.\n\n## TL;DR\nA DOM-based Cross-Site Scripting (XSS) flaw inside the Laravel framework exception renderer allows remote code execution in administrative sessions. The flaw triggers when debugging mode is active and a user hovers over interactive tooltips managed by Tippy.js with allowHTML enabled.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-80\n- **Attack Vector**: Network\n- **CVSS Severity Score**: 3.1 (Low)\n- **EPSS Score**: 0.00202 (Percentile: 9.02%)\n- **Exploit Status**: Proof of Concept\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Laravel applications running versions < 12.69.0 with active debug configurations\n- Laravel applications running versions >= 13.0.0 and < 13.30.0 with active debug configurations\n- **laravel/framework**: < 12.69.0 (Fixed in: `12.69.0`)\n- **laravel/framework**: >= 13.0.0, < 13.30.0 (Fixed in: `13.30.0`)\n\n## Mitigation\n\n- Disable debugging mode by setting APP_DEBUG=false in environment configuration files across all staging and production instances.\n- Limit network exposure of administrative exception reports using IP blocklisting or intranet-only access policies.\n- Enforce content security policies (CSP) that restrict dynamic HTML rendering tools from running inline script vectors.\n\n**Remediation Steps:**\n1. Open the project's root directory and check current framework versions in composer.json.\n2. Run 'composer update laravel/framework' to obtain patched libraries.\n3. Verify the installed package version is 12.69.0, 13.30.0, or newer.\n4. Inspect configuration settings to ensure production systems use APP_DEBUG=false.\n\n## References\n\n- [GitHub Security Advisory GHSA-jh5r-qr3c-85q8](https://github.com/laravel/framework/security/advisories/GHSA-jh5r-qr3c-85q8)\n- [NVD CVE-2026-102279 Analysis](https://nvd.nist.gov/vuln/detail/CVE-2026-102279)\n- [CVE-2026-102279 Record](https://www.cve.org/CVERecord?id=CVE-2026-102279)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-102279) - Automated Vulnerability Intelligence*", "url": "https://gist.github.com/alon710/d482ad55d68c1bdf7dbfc835e6503fef"}, {"timestamp": "2026-09-30T19:38:27.293Z", "date_only": false, "value": "2026-09-30T19:38:27.293", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-102279", "record": "FKIE_CVE-2026-102279", "field": "lastModified"}]}