CVE-2026-102279

Executive Summary

CVE-2026-102279 is a DOM-based cross-site scripting (XSS) vulnerability in the Laravel web application framework affecting versions prior to 12.69.0 and 13.30.0. When an application runs with APP_DEBUG=true, Laravel's exception debug pages render attacker-controlled input inside a Tippy.js tooltip configured with allowHTML: true, allowing arbitrary HTML/JavaScript to execute in the victim's browser upon hover. The issue is rated CVSS 3.1 (Low), reflecting the requirement for a debug configuration that should never be enabled in production, and is fixed in Laravel 12.69.0 and 13.30.0.

Technical Analysis

Laravel is a widely deployed PHP web application framework. Under normal operation, unhandled exceptions and errors are rendered through Laravel's debug exception view (commonly associated with the "Whoops" error handler). This debug page is only displayed when the application environment variable APP_DEBUG is set to true; when APP_DEBUG=false, generic error pages are shown to the user instead.

The vulnerability is a DOM-based cross-site scripting flaw (CWE-80, "Improper Neutralization of Script-Related HTML Tags in a Web Page"). According to the NVD description, Laravel exception debug pages pass attacker-controlled input to a Tippy.js tooltip that is configured with allowHTML: true. Tippy.js is a client-side tooltip library; when allowHTML is enabled, content passed into the tooltip is inserted into the DOM as HTML rather than as text. Consequently, if the input flowing into the tooltip contains attacker-controlled markup, that markup is parsed and rendered by the browser, which is the canonical precondition for DOM-based XSS.

The attacker-controlled input originates from request data that is reflected into the debug output — for example, values embedded in request parameters, headers, or the URL that appear in exception/debug context. Because the tooltip renders this content as HTML on hover, an injected payload is not neutralized the moment the page loads but is executed/rendered when the user hovers over the tooltip element.

Two configuration preconditions define the exposure:

1. APP_DEBUG=true — the debug exception page must be rendered rather than suppressed.
2. A victim user must interact by hovering over the tooltip (UI:R in the CVSS vector).

The CVSS vector (AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N) characterizes the flaw accurately: network-reachable, high attack complexity (reflecting the configuration and interaction requirements), no privileges required, user interaction required, unchanged scope, no confidentiality impact, low integrity impact, and no availability impact.

No public proof-of-concept, exploit code, or Nuclei template is known at this time. All mechanics below are derived strictly from the NVD description and the vulnerability class.

Exploitation Scenarios

No public exploit is available for CVE-2026-102279. The following attack chain is inferred at the vulnerability-class level from the NVD description; no specific function names, parameters, or endpoints beyond those stated (Laravel debug pages, Tippy.js tooltips, APP_DEBUG, allowHTML) are asserted.

1. Reconnaissance / target identification. An attacker identifies a Laravel-backed web application that is running a version below 12.69.0 or 13.30.0 and that has APP_DEBUG=true enabled. Such applications expose verbose framework exception/debug pages instead of generic error responses.

2. Triggering the vulnerable condition. The attacker causes an application exception whose debug rendering includes attacker-influenced input. Because the debug page forwards that input into a Tippy.js tooltip configured with allowHTML: true, the input is treated as HTML by the client-side library rather than being escaped as text.

3. Payload delivery / execution. The crafted input contains HTML/JavaScript markup. When a victim user views the debug page and hovers over the tooltip element, the tooltip content is inserted into the DOM as HTML and the injected markup is rendered — resulting in DOM-based script execution in the victim's browser session (subject to the application's Content Security Policy and browser protections).

4. Post-exploitation impact. Script execution in the victim's authenticated session context can be used to perform actions on the user's behalf, exfiltrate data accessible to the page, or manipulate page content. The CVSS vector assigns only a low integrity impact (I:L) and no confidentiality or availability impact, reflecting that successful exploitation requires the debug configuration and victim hover interaction.

Preconditions summary: APP_DEBUG=true must be active, the target must not yet be patched, and the victim must hover over the affected tooltip (UI:R). The high attack-complexity rating (AC:H) reflects these combined prerequisites.

Impact Assessment

The impact of CVE-2026-102279 is bounded by its prerequisites. A CVSS 3.1 base score of 3.1 (Low) with vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N captures the following subscores:

• Attack Vector (AV:N — Network): The flaw is reachable remotely over the network.
• Attack Complexity (AC:H — High): Exploitation depends on the target running with APP_DEBUG=true and on the specific path of attacker input reaching the vulnerable tooltip rendering.
• Privileges Required (PR:N — None): No authentication is required for the injection step.
• User Interaction (UI:R — Required): A victim must hover over the rendered tooltip for the injected markup to be processed.
• Scope (S:U — Unchanged): Impact remains within the security authority of the vulnerable component.
• Confidentiality (C:N) / Integrity (I:L) / Availability (A:N): No confidentiality or availability impact; a low integrity impact.

Business impact: In the default and recommended production configuration (APP_DEBUG=false), the vulnerable debug page is not rendered and the attack surface is effectively absent — meaning the real-world blast radius is limited to environments that misconfigure debug mode. Where APP_DEBUG=true is mistakenly left enabled in a staging, pre-production, or internet-facing production deployment, an attacker could achieve client-side script execution in the context of users who view the error page. This can facilitate session-context actions, defacement of debug output, or redirection of affected users. There is no evidence of mass exploitation, no CISA KEV listing, and no known threat actor activity.

Detection Guidance

Sigma Rule

title: Laravel Debug Page DOM-Based XSS via Tippy.js Tooltip (CVE-2026-102279)
id: 7f3a9c1e-2b64-4d8a-9e51-1c0a2f6b8d34
status: experimental
description: Detects requests likely to trigger Laravel exception debug pages that reflect attacker-controlled input into a Tippy.js tooltip (allowHTML true), enabling DOM-based XSS when APP_DEBUG is enabled.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-102279
author: Threat Intelligence
date: 2026/01/01
tags:
  - attack.t1190
  - cwe.80
logsource:
  category: webserver
detection:
  selection_debug_indicator:
    response_body|contains:
      - 'allowHTML'
      - 'tippy'
      - 'Whoops'
  selection_suspicious_payload:
    cs-uri-query|contains:
      - '<script'
      - 'onmouseover'
      - 'svg/onload'
      - 'javascript:'
      - '<img'
  condition: selection_debug_indicator and selection_suspicious_payload
falsepositives:
  - Legitimate application traffic containing the substring 'tippy' or '<img' in benign contexts
level: medium

YARA Rule

rule CVE_2026_102279_Laravel_Tippy_DOM_XSS
{
    meta:
        description = "Detects Laravel debug/exception pages that enable HTML rendering in Tippy.js tooltips (allowHTML), the precondition for CVE-2026-102279"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-102279"
        author = "Threat Intelligence"
        date = "2026-01-01"
        severity = "low"

    strings:
        $tippy1 = "tippy" nocase
        $tippy2 = "allowHTML" nocase
        $debug1 = "Whoops" nocase
        $debug2 = "APP_DEBUG" nocase
        $xss1 = "<script" nocase
        $xss2 = "onmouseover" nocase
        $xss3 = "javascript:" nocase

    condition:
        (($tippy1 or $tippy2) and ($debug1 or $debug2)) or
        (($tippy2) and ($xss1 or $xss2 or $xss3))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-102279 Laravel Debug DOM-XSS Probing (Tippy allowHTML)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"<script"; nocase; http.uri; content:"tippy"; nocase; reference:cve,CVE-2026-102279; classtype:web-application-attack; sid:2026102279; rev:1;)

alert http any any -> any any (msg:"CVE-2026-102279 Laravel Debug Page Rendered (allowHTML tooltip)"; flow:established,from_server; http.content_type; content:"text/html"; http.response_body; content:"allowHTML"; nocase; http.response_body; content:"tippy"; nocase; reference:cve,CVE-2026-102279; classtype:web-application-attack; sid:2026102280; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5s
  [ network where http.request.method == "GET" and
      http.request.uri : ("*<script*" or "*onmouseover*" or "*javascript:*" or "*<img*") ]
  [ network where http.response.status_code == 500 and
      http.response.body : ("*tippy*" or "*allowHTML*" or "*Whoops*") ]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=nginx OR sourcetype=apache
| search (uri="*<script*" OR uri="*onmouseover*" OR uri="*javascript:*" OR uri="*<img*")
| eval debug_page_seen=if(match(_raw,"(?i)(tippy|allowHTML|Whoops)"),1,0)
| where debug_page_seen=1
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, uri, status
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="web,appsec,cve-2026-102279,">
  <rule id="1022791" level="6">
    <decoded_as>web-accesslog</decoded_as>
    <url><![CDATA[.*(?:<script|onmouseover|javascript:|<img).*]]></url>
    <description>CVE-2026-102279: Possible Laravel debug DOM-XSS payload in request URI</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>

  <rule id="1022792" level="5">
    <if_sid>1022791</if_sid>
    <match>tippy|allowHTML|Whoops</match>
    <description>CVE-2026-102279: Laravel debug page rendered with Tippy allowHTML tooltip following suspicious input</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The NVD description states the issue is fixed in Laravel 12.69.0 and 13.30.0; however, no vendor advisory, release note, or patch commit has been confirmed via tracked patch sources, so this must be validated directly with upstream release artifacts before relying on it.

1) Immediate mitigations (highest priority — remove the vulnerable precondition):

• Set APP_DEBUG=false in all environments accessible by untrusted users (production especially). This is the single most effective mitigation, as the vulnerable debug/exception page is not rendered when debug mode is disabled. Verify via environment/config auditing.
• If debug output must be temporarily available in a non-production environment, restrict access at the network layer (IP allowlist, VPN, or authentication proxy) so it is not internet-reachable.
• Deploy a strong Content Security Policy (CSP) that disallows inline script execution to reduce the impact of any DOM-based script injection.
• Search application configuration and deployment templates for any hard-coded or inherited APP_DEBUG=true values.

2) Patch / upgrade steps:

• Upgrade Laravel to 12.69.0 or 13.30.0 (or later) as stated in the NVD description. Confirm the fixed release is available in your dependency channel (Composer) and review the upstream changelog/commit once a vendor advisory is published.
• After upgrading, clear cached configuration (php artisan config:clear / recompile caches where applicable) and re-run composer update in a controlled change window.
• Because patch confidence is 0/4, independently verify the fix by reproducing the debug-page behavior in a non-production instance before considering the environment remediated.

3) Long-term hardening:

• Enforce environment-driven configuration so APP_DEBUG cannot be enabled in production (fail-closed CI/CD checks).
• Treat verbose error pages as a security control gap: adopt generic error pages for all unauthenticated users regardless of environment.
• Pin framework dependencies and monitor Laravel security advisories; subscribe to the vendor release channel for authoritative patch confirmation.
• Include DOM-based XSS patterns and client-side tooltip HTML rendering in code review and SAST coverage.

References

• NVD — CVE-2026-102279: https://nvd.nist.gov/vuln/detail/CVE-2026-102279
• Laravel official documentation and release/changelog pages (verify fixed versions 12.69.0 and 13.30.0): https://laravel.com/docs/releases
• CWE-80 — Improper Neutralization of Script-Related HTML Tags in a Web Page: https://cwe.mitre.org/data/definitions/80.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CISA Known Exploited Vulnerabilities Catalog (verify listing status — CVE-2026-102279 is NOT currently listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public proof-of-concept, exploit code, or Nuclei template is available for CVE-2026-102279. No threat actor campaign or exploit-in-the-wild activity has been identified. EPSS has not yet assigned a score per FIRST.org.