What is GHSA-fpx3-h2pc-88vf?

GHSA-fpx3-h2pc-88vf is a security advisory published by GitHub Security Advisories with Medium severity. Laravel Starter Cross Site Scripting (XSS)

Which CVE IDs does GHSA-fpx3-h2pc-88vf cover?

GHSA-fpx3-h2pc-88vf covers the following CVE IDs: CVE-2025-26159. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-fpx3-h2pc-88vf?

GHSA-fpx3-h2pc-88vf has a CVSS v3 base score of 6.1, published by GitHub Security Advisories.

Which products are affected by GHSA-fpx3-h2pc-88vf?

GHSA-fpx3-h2pc-88vf affects 1 product, including: composer/nasirkhan/laravel-starter:\u003c 11.11.0.

GHSA-fpx3-h2pc-88vfMediumCVSS 6.1

Laravel Starter Cross Site Scripting (XSS)

Vendor

GitHub Security Advisories

Published

April 22, 2025

Last Modified

April 22, 2025

🔗 CVE IDs covered (1)

CVE-2025-26159 →

📋 Description

Laravel Starter 11.11.0 is vulnerable to Cross Site Scripting (XSS) in the tags feature. Any user with the ability of create or modify tags can inject malicious JavaScript code in the name field.

🎯 Affected products1

composer/nasirkhan/laravel-starter:< 11.11.0

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2025-26159
https://github.com/nasirkhan/laravel-starter
https://godbadtry.github.io/posts/CVE-2025-26159
https://github.com/advisories/GHSA-fpx3-h2pc-88vf