Laravel Debug Error Page: Route Parameters Can Run Injected JavaScript

Published as "Laravel Reflected XSS via Route Parameter in Debug-Mode Error Page"

medium Laravel Laravel framework · Last reviewed Nov 9, 2026

CVE: CVE-2024-13919
GHSA: GHSA-83wp-f5c3-hqqr
Packagist: PKSA-q46n-4fdk-zjr4
Reported: Dec 13, 2024

Lets a crafted link run JavaScript in a visitor's browser on Laravel 11 apps that show the debug error page with APP_DEBUG=true.

Affected and fixed versions

In laravel/framework. Find the row for the version you run, and update to the release next to it.

If you run	Update to	Support
11.9.0 – 11.35.x	11.36.0

Upgrade

Run the line for the branch you are on.

composer require laravel/framework:^11.36.0

What this means

A crafted link can run JavaScript in the browser of anyone who opens it, on a Laravel app with debug mode turned on. This is cross-site scripting (XSS): the attacker's script runs as if it came from your site, inside the visitor's session.

Who is affected

Apps on laravel/framework 11.9.0 and later, below 11.36.0, are exposed when all of these are true:

APP_DEBUG=true on a site that other people can reach.
A route with a route parameter throws an error and returns a 5xx error page.
A visitor opens a link the attacker sent them.

The debug error page printed route parameters without HTML encoding. Apps with APP_DEBUG=false, the usual production setting, don't show that page and are not exposed. Releases before 11.9.0 are not affected.

What to do

Update laravel/framework to 11.36.0 or later. The fix is in laravel/framework#53869. If you can't update yet, the SBA Research advisory recommends setting APP_DEBUG=false.

Reported by Fabian Funder and Philipp Adelsberger of SBA Research. Jeremy Angele found the same issue on his own and wrote the patch.

Check your app with an agent

Paste this into a coding agent that can read your project, such as Claude Code, Codex or Amp. It checks your composer.lock against the versions above and tells you what to update, without changing anything.

Check whether the PHP project you have access to is affected by this security advisory, and tell me what to update. Do a read-only check: don't edit files, don't run composer update or composer require, and don't try to reproduce the flaw.

Advisory: Laravel Debug Error Page: Route Parameters Can Run Injected JavaScript (CVE-2024-13919, GHSA-83wp-f5c3-hqqr)
Details: https://phpnews.net/security/laravel/ghsa-83wp-f5c3-hqqr

Affected versions, as Composer constraints:
- laravel/framework: >=11.9.0,<11.36.0

Fixed releases:
- 11.9.0 – 11.35.x: update to 11.36.0

1. Find every composer.lock in the project outside vendor/ (a monorepo can have one per app) and read the installed version of each package above. Packages installed as dependencies of other packages count too.
2. Compare each installed version with its constraint: "|" separates alternative ranges, and "," means both bounds apply.
3. For each affected install, read "What this means" at https://phpnews.net/security/laravel/ghsa-83wp-f5c3-hqqr and check whether the project meets the conditions it describes (a feature in use, a config value, a driver) (if that page won't load, use https://github.com/advisories/GHSA-83wp-f5c3-hqqr). Say which conditions you could check and which you couldn't.
4. Report a table: lock file | package | installed version | affected (yes, no or unknown) | conditions met (yes, no or unknown) | update to | evidence. For each affected package, give the command that would fix it, without running it: composer update <package> --with-dependencies when it is only installed as a dependency of another package, or composer require with the fixed version when composer.json requires it directly. If the installed version is on a branch with no fixed release listed, say it needs a move to a newer branch.

Sources

← All Laravel advisories