{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "backpack/crud"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.0.0"
            },
            {
              "fixed": "6.8.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "backpack/crud"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "7.0.0"
            },
            {
              "fixed": "7.0.38"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54181"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1023",
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-20T18:38:50Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nThe Blade template for the `color` column type (`src/resources/views/crud/columns/color.blade.php`) has its escaped/unescaped rendering branches inverted relative to every other column template in the library. Because `$column[\u0027escaped\u0027]` defaults to `true`, values stored in color columns are rendered **unescaped by default**, enabling Stored XSS if column values are not validated before storage.\n\n## Details\n\nAll other column templates in `src/resources/views/crud/columns/` follow the convention:\n- `$column[\u0027escaped\u0027] == true` \u2192 `{{ $column[\u0027text\u0027] }}` (HTML-escaped)\n- `$column[\u0027escaped\u0027] == false` \u2192 `{!! $column[\u0027text\u0027] !!}` (raw)\n\nThe `color` template has these branches swapped. An attacker who can write an arbitrary string to a `color`-typed column can inject JavaScript that executes in the browser of any user who views the list \u2014 including administrators \u2014 with access to their session cookies and CSRF tokens.\n\n## Impact\n\nStored XSS with scope change (attacker context runs in victim\u0027s browser). Highest-risk target is an administrator viewing the list view. Exploitability requires the ability to write an unsanitized value into a `color`-typed column.\n\n## Patches\n\nFixed in **6.8.14** and **7.0.38** by correcting the branch order in `color.blade.php`. See PR #5992.\n\n## Workarounds\n\nValidate stored color values against a strict CSS color grammar (e.g. `/^#[0-9a-fA-F]{3,6}$/`) at the model layer before data reaches the view.\n\n## Credits\n\nReported by Vishal Shukla ([@shukla304](https://github.com/shukla304)) via sechub.dev.",
  "id": "GHSA-mmg4-322v-6jvc",
  "modified": "2026-08-20T18:38:50Z",
  "published": "2026-08-20T18:38:50Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-mmg4-322v-6jvc"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Laravel-Backpack/CRUD"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Laravel-Backpack/CRUD/releases/tag/6.8.14"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Laravel-Backpack/CRUD/releases/tag/7.0.38"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Laravel Backpack CRUD: Stored XSS in the color column \u2014 the `@if($column[\u0027escaped\u0027])` branches are inverted"
}