-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| laravel/framework | composer | >= 11.9.0, < 11.36.0 | 11.36.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper output encoding in Laravel's debug error pages. The commit diff shows the vulnerability was fixed by replacing unescaped Blade template directives {!! !!} with escaped {{ }} syntax in two locations handling request body and route parameters. These template sections directly output user-controlled route parameters without proper HTML encoding in affected versions, making them XSS vectors when debug mode is enabled. While not traditional PHP functions, these Blade template output directives function as the injection points for unescaped content.
A Semantic Attack on Google Gemini - Read the Latest Research