{"id":"CVE-2026-54181","aliases":["GHSA-mmg4-322v-6jvc"],"url":"https://o3.security/vulnerability/CVE-2026-54181","summary":"backpack/crud: Stored XSS in the color column — the `@if($column['escaped'])` branches are inverted","details":"## Summary\n\nThe Blade template for the `color` column type (`src/resources/views/crud/columns/color.blade.php`) has its escaped/unescaped rendering branches inverted relative to every other column template in the library. Because `$column['escaped']` defaults to `true`, values stored in color columns are rendered **unescaped by default**, enabling Stored XSS if column values are not validated before storage.\n\n## Details\n\nAll other column templates in `src/resources/views/crud/columns/` follow the convention:\n- `$column['escaped'] == true` → `{{ $column['text'] }}` (HTML-escaped)\n- `$column['escaped'] == false` → `{!! $column['text'] !!}` (raw)\n\nThe `color` template has these branches swapped. An attacker who can write an arbitrary string to a `color`-typed column can inject JavaScript that executes in the browser of any user who views the list — including administrators — with access to their session cookies and CSRF tokens.\n\n## Impact\n\nStored XSS with scope change (attacker context runs in victim's browser). Highest-risk target is an administrator viewing the list view. Exploitability requires the ability to write an unsanitized value into a `color`-typed column.\n\n## Patches\n\nFixed in **6.8.14** and **7.0.38** by correcting the branch order in `color.blade.php`. See PR #5992.\n\n## Workarounds\n\nValidate stored color values against a strict CSS color grammar (e.g. `/^#[0-9a-fA-F]{3,6}$/`) at the model layer before data reaches the view.\n\n## Credits\n\nReported by Vishal Shukla ([@shukla304](https://github.com/shukla304)) via sechub.dev.","published":"2026-09-14T17:55:45.275Z","modified":"2026-10-02T03:30:45.180967753Z","cvss":{"score":5.4,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Packagist","name":"backpack/crud","fixedVersion":"6.8.14"},{"ecosystem":"Packagist","name":"backpack/crud","fixedVersion":"7.0.38"}],"fix":{"url":"https://github.com/Laravel-Backpack/CRUD/commit/608652b1020ba274781f222d2959d7780a559a08","label":"Laravel-Backpack/CRUD@608652b"},"references":[{"type":"WEB","url":"https://github.com/Laravel-Backpack/CRUD/releases/tag/6.8.14"},{"type":"WEB","url":"https://github.com/Laravel-Backpack/CRUD/releases/tag/7.0.38"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54181.json"},{"type":"ADVISORY","url":"https://github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-mmg4-322v-6jvc"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54181"},{"type":"FIX","url":"https://github.com/Laravel-Backpack/CRUD/commit/608652b1020ba274781f222d2959d7780a559a08"},{"type":"FIX","url":"https://github.com/Laravel-Backpack/CRUD/commit/76c3a6e50e3fbd6d5f633208da5b04acb8322969"},{"type":"FIX","url":"https://github.com/Laravel-Backpack/CRUD/pull/5992"},{"type":"FIX","url":"https://github.com/Laravel-Backpack/CRUD/pull/5994"},{"type":"PACKAGE","url":"https://github.com/Laravel-Backpack/CRUD"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-02T03:30:45.180967753Z"}}