# Security Release: Laravel 6.18.34, 7.23.2

DevFeed: [Security Release: Laravel 6.18.34, 7.23.2](<https://devfeed.tech/articles/security-release-laravel-6-18-34-7-23-2-3904.md>)

Original publisher: [Read original article](<https://laravel.com/blog/security-release-laravel-61834-7232>)

Author: Taylor Otwell

Published: 2020-08-06T15:07:00Z

Content type: release

Language: en

Sources: [Laravel Blog](<https://devfeed.tech/sources/laravel-blog.md>)

Topics: [Laravel](<https://devfeed.tech/topics/laravel.md>), [Security](<https://devfeed.tech/topics/security.md>), [Eloquent ORM](<https://devfeed.tech/topics/eloquent.md>), [releases](<https://devfeed.tech/topics/releases.md>)

Tags: [database](<https://devfeed.tech/tags/database.md>), [feature](<https://devfeed.tech/tags/feature.md>), [laravel](<https://devfeed.tech/tags/laravel.md>), [release](<https://devfeed.tech/tags/release.md>), [releases](<https://devfeed.tech/tags/releases.md>), [security](<https://devfeed.tech/tags/security.md>), [upgrade](<https://devfeed.tech/tags/upgrade.md>), [validation](<https://devfeed.tech/tags/validation.md>)

## AI overview

Laravel released security patches for versions 6.x and 7.x to address unsafe mass assignment of Eloquent attributes containing a model table name. The change removes undocumented automatic table-name stripping, ensuring such attributes follow the usual fillable and guarded rules.

## Source excerpt

Today we released a security patch for Laravel 6.x and 7.x. In previous releases of Laravel, it was possible to mass assign Eloquent attributes that included the model's table name: ``` $model->fill...