CVE-2026-48543: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in krayin laravel-crm
Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the web form description field. Attackers can craft a web form description containing double-brace template syntax that reaches the Vue template compiler, enabling prototype chain traversal to retrieve the Function constructor and execute attacker-supplied JavaScript in the application origin for every user who views the affected web form.
AI Analysis
Technical Summary
CVE-2026-48543 is a stored client-side template injection vulnerability in Krayin laravel-crm through version 2.2.6. Authenticated attackers can inject Vue.js double-brace template syntax into the web form description field. This input reaches the Vue template compiler, enabling prototype chain traversal to access the Function constructor and execute arbitrary JavaScript code in the application origin context for any user who views the compromised web form. This vulnerability allows cross-site scripting (XSS) attacks via stored malicious templates.
Potential Impact
Successful exploitation allows authenticated attackers to execute arbitrary JavaScript in other users' browsers when they view the affected web form. This can lead to session hijacking, unauthorized actions, or data theft within the application context. The vulnerability affects confidentiality and integrity of user sessions and data within the application.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to trusted users only and avoid using or sharing web forms with untrusted descriptions. Monitor vendor channels for official patches or updates addressing this vulnerability.
CVE-2026-48543: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in krayin laravel-crm
Description
Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the web form description field. Attackers can craft a web form description containing double-brace template syntax that reaches the Vue template compiler, enabling prototype chain traversal to retrieve the Function constructor and execute attacker-supplied JavaScript in the application origin for every user who views the affected web form.
CVSS v4.0
Score 5.1medium
Affected software
krayin
laravel-crm
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-48543 is a stored client-side template injection vulnerability in Krayin laravel-crm through version 2.2.6. Authenticated attackers can inject Vue.js double-brace template syntax into the web form description field. This input reaches the Vue template compiler, enabling prototype chain traversal to access the Function constructor and execute arbitrary JavaScript code in the application origin context for any user who views the compromised web form. This vulnerability allows cross-site scripting (XSS) attacks via stored malicious templates.
Potential Impact
Successful exploitation allows authenticated attackers to execute arbitrary JavaScript in other users' browsers when they view the affected web form. This can lead to session hijacking, unauthorized actions, or data theft within the application context. The vulnerability affects confidentiality and integrity of user sessions and data within the application.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to trusted users only and avoid using or sharing web forms with untrusted descriptions. Monitor vendor channels for official patches or updates addressing this vulnerability.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-05-21T18:34:46.417Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ab57e82f7a7c54106c446ee
Added to database: 09/24/2026, 19:48:18 UTC
Last enriched: 09/24/2026, 20:02:47 UTC
Last updated: 09/25/2026, 02:12:42 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.