Query Binding Exploitation in Laravel
Description
Laravel is a web application framework. Versions of Laravel before 6.20.11, 7.30.2 and 8.22.1 contain a query binding exploitation. This same exploit applies to the illuminate/database package which is used by Laravel. If a request is crafted where a field that is normally a non-array value is an array, and that input is not validated or cast to its expected type before being passed to the query builder, an unexpected number of query bindings can be added to the query. In some situations, this will simply lead to no results being returned by the query builder; however, it is possible certain queries could be affected in a way that causes the query to return unexpected results.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Laravel before 6.20.11, 7.30.2, and 8.22.1 allows query binding manipulation via unvalidated array input, potentially returning unexpected query results.
Vulnerability
Overview
CVE-2021-21263 is a query binding exploitation vulnerability in the Laravel web application framework. The issue affects versions of Laravel before 6.20.11, 7.30.2, and 8.22.1, including the underlying illuminate/database package. The root cause is that when a request field that is normally expected to be a non-array value is instead supplied as an array, and that input is not validated or cast to its expected type before being passed to the query builder, an unexpected number of query bindings can be added to the query [1].
AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
laravel/frameworkPackagist | >= 8.0.0, < 8.22.1 | 8.22.1 |
illuminate/databasePackagist | >= 7.0.0, < 7.30.3 | 7.30.3 |
illuminate/databasePackagist | >= 8.0.0, < 8.22.1 | 8.22.1 |
illuminate/databasePackagist | >= 6.0.0, < 6.20.12 | 6.20.12 |
laravel/frameworkPackagist | >= 6.0.0, < 6.20.11 | 6.20.11 |
laravel/frameworkPackagist | >= 7.0.0, < 7.30.2 | 7.30.2 |
Affected products
4- osv-coords3 versions
>= 6.0.0, < 6.20.11+ 2 more
- (no CPE)range: >= 6.0.0, < 6.20.11
- (no CPE)range: >= 7.0.0, < 7.30.3
- (no CPE)range: >= 8.0.0, < 8.22.1
- laravel/frameworkv5Range: >= 6.0.0, < 6.20.11
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
10- github.com/advisories/GHSA-3p32-j457-pg5xghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2021-21263ghsaADVISORY
- blog.laravel.com/security-laravel-62011-7302-8221-releasedghsax_refsource_MISCWEB
- blog.laravel.com/security-laravel-62012-7303-releasedghsaWEB
- github.com/FriendsOfPHP/security-advisories/blob/master/illuminate/database/CVE-2021-21263.yamlghsaWEB
- github.com/FriendsOfPHP/security-advisories/blob/master/laravel/framework/CVE-2021-21263.yamlghsaWEB
- github.com/laravel/framework/pull/35865ghsax_refsource_MISCWEB
- github.com/laravel/framework/security/advisories/GHSA-3p32-j457-pg5xghsax_refsource_CONFIRMWEB
- packagist.org/packages/illuminate/databaseghsax_refsource_MISCWEB
- packagist.org/packages/laravel/frameworkghsax_refsource_MISCWEB
News mentions
0No linked articles in our index yet.