laravel/framework
The project has broad, active maintenance and clear release documentation. Workflow auditing found no untrusted checkout or script injection, though release workflows warrant routine review for template handling.
91%
Total Score
100
100
100
83
Health Score Breakdown
All 13 workflows were analyzed successfully, with no untrusted checkouts or script injections and all 47 action references pinned. High-confidence template-injection findings and top-level write permissions in six workflows are workflow-hygiene concerns, but no untrusted sink was identified to make them a severe risk.
Vulnerabilities
| Title | Versions | Severity |
|---|---|---|
CVE-2026-102279 laravel/framework is vulnerable to Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in versions 0.0.0 - 12.69.0 and 13.0.0 - 13.30.0. | 0.0.0 - 12.69.013.0.0 - 13.30.0 | Low |
AIKIDO-2026-11075 laravel/framework is vulnerable to CRLF Injection in versions 0.0.1 - 12.59.0 and 13.0.0 - 13.9.0. | 0.0.1 - 12.59.013.0.0 - 13.9.0 | High |
AIKIDO-2026-10659 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. laravel/framework is vulnerable to Insufficient Verification of Data Authenticity in versions 5.6.0 - 12.56.0 and 13.0.0 - 13.6.0. | 5.6.0 - 12.56.013.0.0 - 13.6.0 | High |
AIKIDO-2025-10363 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. laravel/framework is vulnerable to Exposure of Sensitive System Information to an Unauthorized Control Sphere in versions 12.0.0 - 12.17.0. | 12.0.0 - 12.17.0 | Low |
CVE-2024-13919 laravel/framework is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in versions 11.9.0 - 11.36.0. | 11.9.0 - 11.36.0 | Medium |
Package versions
Maintainers
 Taylor Otwell |
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 psr/log Version ^1.0 || ^2.0 || ^3.0 | — | — |
brick/math Version ^0.14.2 || ^0.15 || ^0.16 || ^0.17 || ^0.18 || ^0.19 || ^0.20 || ^1.0 | — | — |
league/uri Version ^7.5.1 | — | — |
ramsey/uuid Version ^4.7 | — | — |
symfony/uid Version ^7.4.0 || ^8.0.0 | — | — |
Weekly Downloads
Info
- Last Published
- 16 hours ago
- Created
- 13 years ago
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.