-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PHPPHP| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| illuminate/view | composer | >= 7.0.0, < 7.1.2 | 7.1.2 |
Ongoing coverage of React2Shell
Miggo AIRoot Cause AnalysisThe vulnerability stems from how Blade component attributes were processed. In vulnerable versions (<7.1.2), the ComponentTagCompiler's attributesToString method did not automatically escape string values bound to component attributes. This allowed XSS when user-controlled data was passed to Blade components without manual escaping. The fix in 7.1.2 introduced proper escaping through the $escapeBound parameter, confirming that the lack of automatic escaping in this specific method was the root cause. The pull request (laravel/framework#31945) directly modifies this method's behavior to address the XSS vulnerability.