Skip to content

🚨 [security] [php] Update laravel/framework 12.18.0 → 12.62.0 (minor)#39

Open
depfu[bot] wants to merge 1 commit into
mainfrom
depfu/update/composer/laravel/framework-12.62.0
Open

🚨 [security] [php] Update laravel/framework 12.18.0 → 12.62.0 (minor)#39
depfu[bot] wants to merge 1 commit into
mainfrom
depfu/update/composer/laravel/framework-12.62.0

Conversation

@depfu

@depfu depfu Bot commented Jun 17, 2026

Copy link
Copy Markdown
Contributor

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ laravel/framework (12.18.0 → 12.62.0) · Repo · Changelog

Security Advisories 🚨

🚨 Laravel Framework: CRLF injection in default email rule

Summary

A CRLF injection vulnerability in Laravel's email validation, in combination with how Symfony Mailer and Symfony Mime handle certain character sequences, may allow an unauthenticated attacker to interfere with outbound email processing in applications that send mail to user-supplied addresses.

Description

Laravel applications that send email to addresses provided by users — for example during authentication flows or contact forms — may be vulnerable to manipulation of outbound mail content if the address is not adequately sanitized before it reaches the mail transport layer.
An attacker who can supply an email address to such a flow may, under certain conditions, be able to influence the content of emails sent by the application, cause those emails to be delivered to unintended recipients, or cause the application's mail server to send unintended messages.

Impact

Affected applications may be exposed to unauthorized access and mail relay abuse. The severity depends on what the application sends by email and how its mail infrastructure is configured.

Remediation

Upgrade to version 12.60.0 or later, or 13.10.0 or later.

🚨 Laravel Framework: Temporary Signed URL Path Confusion

A vulnerability in Laravel's local filesystem driver allows temporary signed URLs to be parsed ambiguously, potentially misrouting requests and bypassing expiration enforcement.

Under certain conditions, a generated temporary signed URL can be interpreted differently by the server than intended at signing time. This may cause requests to resolve to an unintended resource, and can prevent expiration from being enforced, allowing expired URLs to remain valid indefinitely.

Impact

  • Expired temporary URLs may continue to be accepted
  • Requests may resolve to a different resource than the one that was signed
  • The upload variant may allow writes to reach an unintended destination
Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ league/commonmark (indirect, 2.7.0 → 2.8.2) · Repo · Changelog

Security Advisories 🚨

🚨 league/commonmark has an embed extension allowed_domains bypass

Impact

The DomainFilteringAdapter in the Embed extension is vulnerable to an allowlist bypass due to a missing hostname boundary assertion in the domain-matching regex. An attacker-controlled domain like youtube.com.evil passes the allowlist check when youtube.com is an allowed domain.

This enables two attack vectors:

  • SSRF: The OscaroteroEmbedAdapter makes server-side HTTP requests to the embed URL via the embed/embed library. A bypassed domain filter causes the server to make outbound requests to an attacker-controlled host, potentially probing internal services or exfiltrating request metadata.
  • XSS: EmbedRenderer outputs the oEmbed response HTML directly into the page with no sanitization. An attacker controlling the bypassed domain can return arbitrary HTML/JavaScript in their oEmbed response, which is rendered verbatim.

Any application using the Embed extension and relying on allowed_domains to restrict domains when processing untrusted Markdown input is affected.

Patches

This has been patched in version 2.8.2. The fix replaces the regex-based domain check with explicit hostname parsing using parse_url(), ensuring exact domain and subdomain matching only.

Workarounds

  • Disable the Embed extension, or restrict its use to trusted users
  • Provide your own domain-filtering implementation of EmbedAdapterInterface
  • Enable a Content Security Policy (CSP) and outbound firewall restrictions

🚨 CommonMark has DisallowedRawHtml extension bypass via whitespace in HTML tag names

Impact

The DisallowedRawHtml extension can be bypassed by inserting a newline, tab, or other ASCII whitespace character between a disallowed HTML tag name and the closing >. For example, <script\n> would pass through unfiltered and be rendered as a valid HTML tag by browsers. This is a cross-site scripting (XSS) vector for any application that relies on this extension to sanitize untrusted user input.

All applications using the DisallowedRawHtml extension to process untrusted markdown are affected. Applications that use a dedicated HTML sanitizer (such as HTML Purifier) on the rendered output are not affected.

Patches

Fixed in 2.8.1. The regex character class [ \/>] was changed to [\s\/>] to match all whitespace characters that browsers accept as valid tag name terminators.

Workarounds

  • Set the html_input configuration option to 'escape' or 'strip' to disable all raw HTML, though this is a broader restriction than the DisallowedRawHtml extension provides.
  • Pass the rendered HTML through a dedicated HTML sanitizer before serving it to users (always recommended)
Release Notes

2.8.2

This is a security release to address an issue where the allowed_domains setting for the Embed extension can be bypassed, resulting in a possible SSRF and XSS vulnerabilities.

Fixed

  • Fixed DomainFilteringAdapter hostname boundary bypass where domains like youtube.com.evil could match an allowlist entry for youtube.com (GHSA-hh8v-hgvp-g3f5)

Full Changelog: 2.8.1...2.8.2

2.8.1

What's Changed

This is a security release to address an issue where DisallowedRawHtml can be bypassed, resulting in a possible cross-site scripting (XSS) vulnerability.

Fixed

  • Fixed DisallowedRawHtmlRenderer not blocking raw HTML tags with trailing ASCII whitespace (GHSA-4v6x-c7xx-hw9f)
  • Fixed PHP 8.5 deprecation (#1107)

New Contributors

Full Changelog: 2.8.0...2.8.1

2.8.0

What's Changed

Added

  • Added a new HighlightExtension for marking important text using == syntax (#1100)

Fixed

  • Fixed AutolinkExtension incorrectly matching URLs after invalid www. prefix (#1095, #1103)

New Contributors

Full Changelog: 2.7.1...2.8.0

2.7.1

Notable Changes

Changed

  • Optimized several regular expressions in RegexHelper to improve performance (#674, #1086)

Fixed

  • EmbedProcessor no longer calls updateEmbeds() when there are no embeds to update (#1081)
  • Fixed missing benchmark.php CSV path validation for non-existent files (#1068, #1085)

New Contributors

Full Changelog: 2.7.0...2.7.1

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 65 commits:

↗️ symfony/polyfill-php83 (indirect, 1.32.0 → 1.38.2) · Repo

Release Notes

1.38.2

Changelog (v1.38.1...v1.38.2)

  • bug #622 Fix issues with mb_str_pad() (@GPHemsley)

1.38.1

Changelog (v1.38.0...v1.38.1)

  • bug #619 Isolate PHP 7 mb_* declarations into bootstrap72.php (@nicolas-grekas)

1.38.0

Changelog (v1.34.0...v1.38.0)

1.37.0

Changelog (v1.36.0...v1.37.0)

  • no significant changes

1.36.0

Changelog (v1.35.0...v1.36.0)

  • no significant changes

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 14 commits:

🆕 symfony/polyfill-php84 (added, 1.38.1)

🆕 symfony/polyfill-php85 (added, 1.38.1)

Depfu Status

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands
@​depfu rebase
Rebases against your default branch and redoes this update
@​depfu recreate
Recreates this PR, overwriting any edits that you've made to it
@​depfu merge
Merges this PR once your tests are passing and conflicts are resolved
@​depfu cancel merge
Cancels automatic merging of this PR
@​depfu close
Closes this PR and deletes the branch
@​depfu reopen
Restores the branch and reopens this PR (if it's closed)
@​depfu pause
Ignores all future updates for this dependency and closes this PR
@​depfu pause [minor|major]
Ignores all future minor/major updates for this dependency and closes this PR
@​depfu resume
Future versions of this dependency will create PRs again (leaves this PR as is)

@depfu depfu Bot added the depfu label Jun 17, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

depfu

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants