AIKIDO-2025-10705

yajra/laravel-datatables-oracle is vulnerable to Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')

Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') Pre-CVE Published Oct 10, 2025

High Risk

This Affects:

yajra/laravel-datatables-oracle

5.11.7 - 12.5.1

Fixed in 12.6.0

Are you affected? Scan for Free

TL;DR

Affected versions of this package are vulnerable to Remote Code Execution due to improper handling of Blade templates. The vulnerability occurs because user-controlled template content is processed using the unsafe eval() function instead of the secure Blade::render() method. An attacker could exploit this by injecting malicious PHP code into a Blade template, which would then be executed with the application's privileges when the template is compiled. It could lead to complete compromise of the application server and underlying system.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range.

Background info

yajra/laravel-datatables-oracle is vulnerable to Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in versions 5.11.7 - 12.5.1.