---
id: "CVE-2026-120488"
kind: "vulnerability"
aliases: ["CVE-2026-120488"]
title: "LaraDashboard: stored script injection through page builder blocks hits admin sessions"
severity: "medium"
cvss: 5.4
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["laradashboard", "laravel", "other", "self-hosted"]
not_affected_if: ["only-trusted-editors", "version-1.4.9-or-later"]
published_at: "2026-11-02T15:17:30+00:00"
first_seen_at: "2026-11-02T15:24:04+00:00"
updated_at: "2026-11-02T15:26:23+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120488", "first_seen_at": "2026-11-02T15:24:04+00:00"}]
---

# LaraDashboard: stored script injection through page builder blocks hits admin sessions

LaraDashboard before 1.4.9 does not sanitize content in its LaraBuilder design blocks, so a user with post create or edit permission can save script markup that stores in the page. When an administrator or Superadmin opens the builder, preview or page, that script runs in their session.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed LaraDashboard version and confirm it is `1.4.9` or later.
- Look for users who hold `post.create` or `post.edit` permission and confirm they are trusted.
- Review saved LaraBuilder `design_json` blocks for script or event-handler markup.

## Fix

- Move LaraDashboard to `1.4.9` or later.

## Timeline

- 2026-11-02T15:24:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120488

## Documents

- [advisory] Vendor advisory: github.com https://github.com/laradashboard/laradashboard/security/advisories/GHSA-9gg9-jh9p-fw37
- [advisory] Vendor advisory: github.com https://github.com/laradashboard/laradashboard/security/advisories/GHSA-rf5h-55h2-jmf8
- [advisory] Vendor advisory: github.com https://github.com/laradashboard/laradashboard/security/advisories/GHSA-w878-x2w9-3r6f
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/laradashboard-before-1.4.9-stored-xss-via-larabuilder-design-json-block-content
- [fix] Patch: github.com https://github.com/laradashboard/laradashboard/commit/5955d725683b1e63af8c38a149211d6151465aed
- [fix] Release notes: github.com https://github.com/laradashboard/laradashboard/releases/tag/v1.4.9

## From the sources

LaraDashboard before 1.4.9 contains a stored cross-site scripting vulnerability that allows authenticated users with post.create or post.edit permission to inject scripts via unsanitized LaraBuilder design_json block content. Attackers can save text-editor, HTML, text or heading blocks containing script or event-handler markup that executes in administrator or Superadmin sessions viewing the builder, preview or page.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_