CVE-2021-21263 json
Query Binding Exploitation in Laravel
published 2021-01-19 5 y ago modified 2026-09-10 1 mo ago also BIT-laravel-2021-21263 , EUVD-2021-0484 , GHSA-3p32-j457-pg5x
- cvss
- 7.2
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.6%
- EPSS 1.6% chance of exploitation in 30 days, percentile 76%
- public exploits
- 0
- none known
Summary
Laravel is a web application framework. Versions of Laravel before 6.20.11, 7.30.2 and 8.22.1 contain a query binding exploitation. This same exploit applies to the illuminate/database package which is used by Laravel. If a request is crafted where a field that is normally a non-array value is an array, and that input is not validated or cast to its expected type before being passed to the query builder, an unexpected number of query bindings can be added to the query. In some situations, this will simply lead to no results being returned by the query builder; however, it is possible certain queries could be affected in a way that causes the query to return unexpected results.
Patch / fix
- packagist laravel/framework 6.20.11, 7.30.2, 8.22.1
- packagist illuminate/database 6.20.12, 7.30.3, 8.22.1
- bitnami laravel 6.20.11, 7.30.2, 8.22.1
- laravel laravel 6.20.11, 7.30.2, 8.22.1
- php-laravel-framework Debian 14, Debian 13, Debian 12 6.20.11+dfsg-1
debian advisories DEBIAN-CVE-2021-21263
- github.com/laravel/framework#35865 pull request
Exploit prediction
1.63% chance of exploitation in the next 30 days, higher than 76% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.2 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N |
| GitHub | 3.1 | 7.2 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N |
| NVD | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:N/I:P/A:N |
| OSV | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | laravel/framework | >=8.0.0, <8.22.1 >=6.0.0, <6.20.11 >=7.0.0, <7.30.2 |
8.22.1 6.20.11 7.30.2 |
| packagist | illuminate/database | >=7.0.0, <7.30.3 >=8.0.0, <8.22.1 >=6.0.0, <6.20.12 |
7.30.3 8.22.1 6.20.12 |
| bitnami | laravel | >=6.0.0, <6.20.11 >=7.0.0, <7.30.2 >=8.0.0, <8.22.1 |
6.20.11 7.30.2 8.22.1 |
Affected products
- laravel framework
Classification
References
-
github.com
/laravel/framework/pull/35865
web, patch, third-party-advisory
-
blog.laravel.com
/security-laravel-62011-7302-8221-released
web, vendor-advisory
-
github.com
/laravel/framework/security/advisories/GHSA-3p32-j457-pg5x
web, third-party-advisory
-
packagist.org
/packages/laravel/framework
web, product, third-party-advisory
-
packagist.org
/packages/illuminate/database
web, product, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2021-21263
advisory, web
-
blog.laravel.com
/security-laravel-62012-7303-released
web
-
github.com
/FriendsOfPHP/security-advisories/blob/master/illuminate/database/CVE-2021-21263.yaml
web
-
github.com
/FriendsOfPHP/security-advisories/blob/master/laravel/framework/CVE-2021-21263.yaml
web
Sources
- CVE List CVE-2021-21263
- GitHub Advisory GHSA-3p32-j457-pg5x
- NVD CVE-2021-21263
- OSV BIT-laravel-2021-21263
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.