CVE-2026-48541 in laravel-crm
Summary
by MITRE • 09/24/2026
Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the person name field. Attackers can craft a person name containing double-brace template syntax that reaches the Vue template compiler, enabling prototype chain traversal to retrieve the Function constructor and execute attacker-supplied JavaScript in the application origin for every user who views the affected person record.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/24/2026
The vulnerability identified in Krayin CRM versions through 2.2.6 represents a critical stored client-side template injection flaw rooted in the improper handling of untrusted input within Vue.js templating logic. This security defect allows authenticated attackers to inject malicious payload data that persists on the server and is subsequently rendered by victim browsers, leading to cross-site scripting-like effects but with significantly higher severity due to its persistence and potential for broader impact. The core technical flaw lies in the application's failure to sanitize or escape double-brace template syntax when storing person names. Because Krayin CRM utilizes Vue.js as its frontend framework, any data entered into fields that are bound directly to templates without proper escaping will be interpreted by the Vue compiler rather than treated as static text. When an attacker crafts a person name containing specific JavaScript expressions wrapped in double braces, such as {{constructor.constructor('malicious_code')()}}, this input is stored in the database and later retrieved for display.
The operational mechanism of this exploit relies on the powerful capabilities inherent to modern client-side template engines like Vue.js. By injecting these expressions into the person name field, the attacker ensures that when another user views a record containing this malicious data, the browser's JavaScript engine parses the content as executable code rather than plain text. The vulnerability specifically enables prototype chain traversal, allowing the injected script to access global objects and constructors that are typically restricted in standard cross-site scripting scenarios. This capability allows the retrieval of the Function constructor, which can then be used to execute arbitrary JavaScript within the context of the application's origin. Unlike traditional XSS where execution might be limited by same-origin policies or content security policies, this template injection effectively bypasses these controls because the code is executed as part of the legitimate application logic during rendering.
The impact of this vulnerability extends beyond simple data theft or session hijacking, although those remain significant risks. Since the payload executes in every user's browser who views the affected person record, it facilitates a persistent and widespread compromise of the web application environment. Attackers can use this access to steal sensitive information such as authentication tokens, personal identifiable information stored within the CRM, or internal configuration details. Furthermore, because the execution occurs for any viewer, an attacker could potentially perform actions on behalf of victims, manipulate UI elements to facilitate phishing attacks against other employees, or exfiltrate data from connected systems if additional browser-based APIs are accessible. The persistent nature means that even after the initial attack vector is discovered and patched, previously stored malicious records continue to pose a threat until they are manually cleaned or overwritten with safe data.
From an industry standard perspective, this vulnerability aligns closely with CWE-94, which describes Improper Control of Generation of Code (Code Injection), specifically in the context of client-side template injection. It also maps to MITRE ATT&CK technique T1059, Command and Scripting Interpreter, as it allows for arbitrary code execution via JavaScript within a web application environment. The stored nature of the payload corresponds to CWE-79, Improper Neutralization of Input During Web Page Generation (Cross-site Scripting), but with the added complexity of template engine exploitation rather than simple HTML/JS injection. Understanding these mappings helps in categorizing the risk correctly and applying appropriate remediation strategies that address both input validation and output encoding requirements for modern JavaScript frameworks.
Mitigation requires a multi-layered approach focusing on secure coding practices within Vue.js applications. The primary defense is to ensure that all user-supplied data rendered into templates is properly escaped or sanitized before being processed by the template engine. In Vue.js, this can be achieved by using double curly braces for safe interpolation where automatic escaping occurs, rather than v-html directives which bypass security measures and render raw HTML/JavaScript. If dynamic content must be displayed, developers should implement strict allow-listing of permitted characters in input fields like person names to prevent the injection of special syntax such as double braces or JavaScript operators. Additionally, implementing a Content Security Policy (CSP) with nonces or hashes can restrict the execution of inline scripts and eval-like functions, providing an additional layer of defense even if template injection occurs. Regular security audits focusing on input validation for all fields bound to reactive data models are essential to prevent similar vulnerabilities in future versions.