{"id":"CVE-2026-54181","summary":"backpack/crud: Stored XSS in the color column — the `@if($column['escaped'])` branches are inverted","details":"backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.14 and 7.0.38, src/resources/views/crud/columns/color.blade.php inverts the escaped and raw rendering branches controlled by $column['escaped'], which defaults to true, causing $column['text'] to be rendered unescaped by default. An attacker who can store an unsanitized value in a color column can execute script in the browser of a user who views the CRUD list, including an administrator, with access to the victim's session-backed application capabilities. Exploitation requires write access to the stored color value and a victim viewing the list. This issue is fixed in versions 6.8.14 and 7.0.38.","aliases":["GHSA-mmg4-322v-6jvc"],"modified":"2026-09-16T03:46:15.961942400Z","published":"2026-09-14T17:55:45.275Z","database_specific":{"cwe_ids":["CWE-1023","CWE-79"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54181.json","cna_assigner":"GitHub_M"},"references":[{"type":"WEB","url":"https://github.com/Laravel-Backpack/CRUD/releases/tag/6.8.14"},{"type":"WEB","url":"https://github.com/Laravel-Backpack/CRUD/releases/tag/7.0.38"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54181.json"},{"type":"ADVISORY","url":"https://github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-mmg4-322v-6jvc"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54181"},{"type":"FIX","url":"https://github.com/Laravel-Backpack/CRUD/commit/608652b1020ba274781f222d2959d7780a559a08"},{"type":"FIX","url":"https://github.com/Laravel-Backpack/CRUD/commit/76c3a6e50e3fbd6d5f633208da5b04acb8322969"},{"type":"FIX","url":"https://github.com/Laravel-Backpack/CRUD/pull/5992"},{"type":"FIX","url":"https://github.com/Laravel-Backpack/CRUD/pull/5994"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/laravel-backpack/crud","events":[{"introduced":"56c091f2099b6e17a37034e76a1da65f9052e842"},{"introduced":"9abc482607aaaefcd6ee2455bc0a6e603cc1b69f"},{"fixed":"76c3a6e50e3fbd6d5f633208da5b04acb8322969"},{"fixed":"5c5de0af242619d0653c7c70c900cd15b1a197c5"},{"fixed":"608652b1020ba274781f222d2959d7780a559a08"}],"database_specific":{"source":["AFFECTED_FIELD","REFERENCES"],"extracted_events":[{"introduced":"6.0.0"},{"fixed":"6.8.14"},{"introduced":"7.0.0"},{"fixed":"7.0.38"}]}}],"versions":["6.8.13","7.0.37","7.0.36","6.8.12","7.0.35","7.0.34","6.8.11","7.0.33","7.0.32","7.0.31","7.0.30","6.8.10","7.0.29","7.0.28","7.0.27","7.0.26","7.0.25","7.0.24","7.0.23","7.0.22","7.0.21","6.8.9","7.0.20","7.0.19","7.0.18","7.0.17","7.0.16","7.0.15","7.0.14","7.0.13","7.0.12","7.0.11","7.0.10","7.0.9","7.0.8","7.0.7","7.0.6","7.0.5","7.0.4","7.0.3","7.0.2","7.0.1","7.0.0","6.8.8","6.8.7","6.8.6","6.8.5","6.8.4","6.8.3","6.8.2","6.8.1","7.0.0-alpha.2","6.8.0","6.7.56","6.7.55","6.7.54","6.7.53","6.7.52","6.7.51","6.7.50","6.7.49","6.7.48","6.7.47","6.7.46","6.7.45","6.7.44","6.7.43","6.7.42","6.7.41","6.7.40","6.7.39","6.7.38","6.7.37","6.7.36","6.7.35","6.7.34","6.7.33","6.7.32","6.7.31","6.7.30","6.7.29","6.7.28","6.7.26","6.7.27","6.7.25","6.7.24","6.7.23","6.7.22","6.7.21","6.7.20","6.7.19","6.7.18","6.7.17","6.7.16","6.7.15","6.7.14","6.7.13","6.7.12","6.7.11","6.7.10","6.7.9","6.7.8","6.7.7","6.7.6","6.7.5","6.7.4","6.7.3","6.7.2","6.7.1","6.7.0","6.6.6","6.6.5","6.6.4","6.6.3","6.6.2","6.6.1","6.6.0","6.5.5","6.5.4","6.5.3","6.5.2","6.5.1","6.5.0","6.4.2","6.4.1","6.4.0","6.3.2","6.3.1","6.3.0","6.2.4","6.2.3","6.2.1","6.2.2","6.2.0","6.1.16","6.1.15","6.1.14","6.1.13","6.1.12","6.1.11","6.1.10","6.1.9","6.1.8","6.1.7","6.1.6","6.1.5","6.1.4","6.1.3","6.1.2","6.1.1","6.1.0","6.0.7","6.0.6","6.0.5","6.0.4","6.0.3","6.0.2","6.0.0","6.0.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54181.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"}]}