Packagist · backpack/crud
Laravel Backpack CRUD: Stored XSS in the color column — the `@if($column['escaped'])` branches are inverted
The Blade template for the color column type (src/resources/views/crud/columns/color.blade.php) has its escaped/unescaped rendering branches inverted relative to every other column template in the library. Because $column['escaped'] defaults to true, values stored in color columns are rendered unescaped by default, enabling Stored XSS if column values are not validated before storage.
All other column templates in src/resources/views/crud/columns/ follow the convention:
$column['escaped'] == true → {{ $column['text'] }} (HTML-escaped)$column['escaped'] == false → {!! $column['text'] !!} (raw)The color template has these branches swapped. An attacker who can write an arbitrary string to a color-typed column can inject JavaScript that executes in the browser of any user who views the list — including administrators — with access to their session cookies and CSRF tokens.
Stored XSS with scope change (attacker context runs in victim's browser). Highest-risk target is an administrator viewing the list view. Exploitability requires the ability to write an unsanitized value into a color-typed column.
Fixed in 6.8.14 and 7.0.38 by correcting the branch order in color.blade.php. See PR #5992.
Validate stored color values against a strict CSS color grammar (e.g. /^#[0-9a-fA-F]{3,6}$/) at the model layer before data reaches the view.
Reported by Vishal Shukla (@shukla304) via sechub.dev.
Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.
Check my repoSources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.