krayin laravel-crm up to 2.2.6 Web Form Description special elements in template engine

Summaryinfo

A vulnerability described as critical has been identified in krayin laravel-crm up to 2.2.6. The affected element is an unknown function of the component Web Form. Such manipulation of the argument Description leads to special elements in template engine. This vulnerability is listed as CVE-2026-48543. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability was found in krayin laravel-crm up to 2.2.6. It has been rated as critical. Affected by this issue is an unknown code block of the component Web Form. The manipulation of the argument description with an unknown input leads to a special elements in template engine vulnerability. Using CWE to declare the problem leads to CWE-1336. The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the web form description field. Attackers can craft a web form description containing double-brace template syntax that reaches the Vue template compiler, enabling prototype chain traversal to retrieve the Function constructor and execute attacker-supplied JavaScript in the application origin for every user who views the affected web form.

The advisory is available at github.com. This vulnerability is handled as CVE-2026-48543 since 05/21/2026. The exploitation is known to be easy. The attack may be launched remotely. Successful exploitation requires user interaction by the victim. Technical details are known, but there is no available exploit. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 09/24/2026). This vulnerability is assigned to T1221 by the MITRE ATT&CK project.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Customer Relationship Management System

Vendor

• krayin

Name

• laravel-crm

Version

• 2.2.0
• 2.2.1
• 2.2.2
• 2.2.3
• 2.2.4
• 2.2.5
• 2.2.6

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion