{"id":"CVE-2026-120488","title":"LaraDashboard before 1.4.9 Stored XSS via LaraBuilder design_json Block Content","summary":"LaraDashboard before 1.4.9 contains a stored cross-site scripting vulnerability that allows authenticated users with post.create or post.edit permission to inject scripts via unsanitized LaraBuilder design_json block content. Attackers c…","severity":"medium","cvss":5.4,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","cvssSource":"cna","cwe":["CWE-79"],"vendor":"LaraDashboard","product":"LaraDashboard","affected":["LaraDashboard < 1.4.9"],"published":"2026-11-02","updated":"2026-11-02","sourceUpdated":"2026-11-02T14:29:18.584Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-120488","references":[{"url":"https://github.com/laradashboard/laradashboard/security/advisories/GHSA-w878-x2w9-3r6f","label":"GitHub Security Advisory (GHSA-w878-x2w9-3r6f)"},{"url":"https://github.com/laradashboard/laradashboard/security/advisories/GHSA-rf5h-55h2-jmf8","label":"GitHub Security Advisory (GHSA-rf5h-55h2-jmf8)"},{"url":"https://github.com/laradashboard/laradashboard/security/advisories/GHSA-9gg9-jh9p-fw37","label":"GitHub Security Advisory (GHSA-9gg9-jh9p-fw37)"},{"url":"https://github.com/laradashboard/laradashboard/commit/5955d725683b1e63af8c38a149211d6151465aed"},{"url":"https://github.com/laradashboard/laradashboard/releases/tag/v1.4.9","label":"LaraDashboard v1.4.9 Release Notes"},{"url":"https://github.com/laradashboard/laradashboard/blob/v1.4.8/resources/js/lara-builder/blocks/text-editor/render.php#L99-L104"},{"url":"https://www.vulncheck.com/advisories/laradashboard-before-1.4.9-stored-xss-via-larabuilder-design-json-block-content","label":"VulnCheck Advisory: LaraDashboard before 1.4.9 Stored XSS via LaraBuilder design_json Block Content"}],"tags":["cve.org"],"epss":0.00218,"epssPercentile":0.1242,"ingestedAt":"2026-11-05T19:30:42.662Z","slug":"CVE-2026-120488","body":"## Overview\n\nLaraDashboard before 1.4.9 contains a stored cross-site scripting vulnerability that allows authenticated users with post.create or post.edit permission to inject scripts via unsanitized LaraBuilder design_json block content. Attackers can save text-editor, HTML, text or heading blocks containing script or event-handler markup that executes in administrator or Superadmin sessions viewing the builder, preview or page.\n\n## Affected\n\n- `LaraDashboard < 1.4.9`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":29.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}