GHSA-rc8x-jrrc-frfv moderate
Laravel does not properly constrain the host portion of a password-reset URL
Affected range
ECOSYSTEM: introduced 5.4.0; fixed 5.4.22>=5.4.0,<5.4.22Fixed versions: 5.4.22
Vulnerability intelligence Composer
laravel/laravel
The skeleton application for the Laravel framework.
Composer latest 13.10.1 MIT
Evidence path
Version, exploitation, severity
RequestGuard keeps these facts separate. A KEV match refers to a CVE, while OSV supplies the package and version match.
1
Latest version
13.10.1
No matching published advisory returned
2
Known exploitation
No KEV match
Checked by exact CVE identifier
3
Highest advisory severity
Moderate
1 active advisory
Check an exact version
The registry confirms the version, then OSV checks advisories for that exact value.
Published records