Threats affecting pkg:github/laravel/framework

A vulnerability in the Laravel framework versions 12.45.0 through 12.67.9 and 13.0.0 through 13.26.9 allows a user with read-only access to trigger destructive database operations on related tables via crafted relationship inclusion on a read-only endpoint. This can lead to irreversible data loss, denial of service, and loss of data integrity. The issue is fixed in versions 12.68.0 and 13.27.0.

Laravel is a web application framework. Prior to 12.69.0 and 13.30.0, Laravel exception debug pages with APP_DEBUG=true pass attacker-controlled input to a Tippy.js tooltip configured with allowHTML true, enabling DOM-based cross-site scripting when a user hovers over the tooltip. This issue is fixed in versions 12.69.0 and 13.30.0.