Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
28 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact Those using SQL Server with Laravel and allowing user input to be passed directly to the limit and offset functions are vulnerable to SQL injection. Other database drivers such as MySQL and Postgres are not affected by this vulnerability. Patches This problem has been patched on Laravel versions 6.20.26, 7.30.5, and 8.40.0. Workarounds You may workaround this vulnerability by ensuring that only integers are passed to the limit and offset functions, as well as the skip and take functions.
Recommended action: Upgrade to 8.40.0 or 6.20.26 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
This is a follow-up to the previous security advisory (GHSA-3p32-j457-pg5x) which addresses a few additional edge cases. If a request is crafted where a field that is normally a non-array value is an array, and that input is not validated or cast to its expected type before being passed to the query builder, an unexpected number of query bindings can be added to the query. In some situations, this will simply lead to no results being returned by the query builder; however, it is possible certain queries could be affected in a way that causes the query to return unexpected results.
Recommended action: Upgrade to 8.24.0, 7.30.4 or 6.20.14 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Laravel versions <6.20.12, <7.30.3 & <8.22.1 contain a query binding exploitation. If a request is crafted where a field that is normally a non-array value is an array, and that input is not validated or cast to its expected type before being passed to the query builder, an unexpected number of query bindings can be added to the query. In some situations, this will simply lead to no results being returned by the query builder; however, it is possible certain queries could be affected in a way that causes the query to return unexpected results. This vulnerability was discovered by Tim Groenevelt (tim.g@foodbyus.com). References - https://github.com/laravel/framework/pull/35865
Recommended action: Upgrade to 8.22.1, 7.30.2 or 6.20.11 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.