Detections
Analytics
SCA: security update for backpack/crud (GHSA-mmg4-322v-6jvc)
medium Tenable Cloud Security Plugin ID 446172
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of
Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.14 and 7.0.38,
src/resources/views/crud/columns/color.blade.php inverts the escaped and raw rendering branches controlled
by $column['escaped'], which defaults to true, causing $column['text'] to be rendered unescaped by
default. An attacker who can store an unsanitized value in a color column can execute script in the
browser of a user who views the CRUD list, including an administrator, with access to the victim's
session-backed application capabilities. Exploitation requires write access to the stored color value and
a victim viewing the list. This issue is fixed in versions 6.8.14 and 7.0.38. (CVE-2026-54181)
Solution
Update the backpack/crud library and its related packages to version 6.8.14 or later.See Also
Plugin Details
Severity: Medium
ID: 446172
Version: Revision 1.2
Type: Local
Family: SCA Checks
Published: 8/20/2026
Updated: 9/15/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Low
Score: 2.3
Percentile: 9.76
Vendor
Vendor Severity: Medium
CVSS v2
Risk Factor: Medium
Base Score: 5.5
Temporal Score: 4.1
Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:N
CVSS Score Source: CVE-2026-54181
CVSS v3
Risk Factor: Medium
Base Score: 5.4
Temporal Score: 4.7
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 8/20/2026
Vulnerability Publication Date: 8/20/2026
Reference Information
CVE: CVE-2026-54181