Laravel-Backpack CRUD provides administrative panel functions and includes a color column rendering feature. Between versions 6.0.0 and 6.8.14, and 7.0.0 and 7.0.38, the rendering logic in src/resources/views/crud/columns/color.blade.php mistakenly inverts the escaping logic controlled by $column['escaped'], which defaults to true. This causes $column['text'] to be rendered unescaped by default, enabling stored cross-site scripting if an attacker can write unsanitized values to the color column. Exploitation requires the attacker to have write access to the stored value and a victim user to view the affected list. The vulnerability is addressed by correcting the escaping behavior in versions 6.8.14 and 7.0.38.

An attacker with write access to the color column can inject malicious scripts that execute in the browsers of users viewing the CRUD list, including administrators. This can lead to session hijacking or unauthorized actions within the application context. The CVSS 3.1 base score is 5.4 (medium severity), reflecting network attack vector, low attack complexity, required privileges, user interaction, and partial confidentiality and integrity impact without availability impact.

Upgrade Laravel-Backpack CRUD to version 6.8.14 or later in the 6.x series, or 7.0.38 or later in the 7.x series, where the escaping logic has been corrected. No other mitigations are specified or required once patched.