CVE-2026-54181: Laravel Backpack CRUD: Stored XSS in the color column — the `@if($column['escaped'])` branches are inverted
The Blade template for the color column type (src/resources/views/crud/columns/color.blade.php) has its escaped/unescaped rendering branches inverted relative to every other column template in the library. Because $column['escaped'] defaults to true, values stored in color columns are rendered unescaped by default, enabling Stored XSS if column values are not validated before storage.
References
Code Behaviors & Features
Detect and mitigate CVE-2026-54181 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →