{"id":"GHSA-fpx3-h2pc-88vf","aliases":["CVE-2025-26159"],"title":"Laravel Starter Cross Site Scripting (XSS)","titleSource":"OSV","descriptionSource":"OSV","declaredSeverity":"MODERATE","description":"Laravel Starter 11.11.0 is vulnerable to Cross Site Scripting (XSS) in the tags feature. Any user with the ability of create or modify tags can inject malicious JavaScript code in the name field.","severity":"medium","score":6.1,"published":"2025-04-22T21:30:44.000Z","modified":"2025-04-22T22:27:12.814Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"nasirkhan/laravel-starter","sources":[{"name":"OSV · GHSA-fpx3-h2pc-88vf","url":"https://osv.dev/vulnerability/GHSA-fpx3-h2pc-88vf"}],"ranges":[{"events":[{"introduced":"0"},{"fixed":"11.11.0"}],"type":"ECOSYSTEM"}],"versions":["v1.0.0","v1.1.0","v10.0.0","v10.1.0","v10.10.0","v10.11.0","v10.12.0","v10.13.0","v10.14.0","v10.14.1","v10.15.0","v10.16.0","v10.17.0","v10.18.0","v10.2.0","v10.3.0","v10.3.1","v10.4.0","v10.5.0","v10.6.0","v10.7.0","v10.7.1","v10.8.0","v10.8.1","v10.9.0","v11.0.0","v11.0.1","v11.1.0","v11.10.0","v11.2.0","v11.3.0","v11.4.0","v11.5.0","v11.6.0","v11.7.0","v11.8.0","v11.9.0","v2.0.0","v3.6.0","v5.1.0","v6.0.0","v7.10.0","v7.11.0","v7.12.0","v7.14.0","v7.5.0","v7.9.0","v8.0.0","v8.1.0","v8.2.1","v8.3.0","v8.4.1","v8.4.2","v9.0.0","v9.1.0","v9.10.0","v9.11.0","v9.12.0","v9.13.0","v9.14.0","v9.15.0","v9.16.0"],"fixed":["11.11.0"]}],"sourceAffected":[],"references":["https://nvd.nist.gov/vuln/detail/CVE-2025-26159","https://github.com/nasirkhan/laravel-starter","https://godbadtry.github.io/posts/CVE-2025-26159"],"sources":[{"name":"OSV","id":"GHSA-fpx3-h2pc-88vf","modified":"2025-04-22T22:27:12.814851Z","url":"https://osv.dev/vulnerability/GHSA-fpx3-h2pc-88vf"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","score":6.1}],"products":[],"remediation":[],"kev":{"status":"not-listed","checkedAt":"2026-10-28T19:20:37.165Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}