CVE-2026-55409 json
Filament: Disabled RichEditor field state can be used for XSS
published 2026-06-17 4 mo ago modified 2026-11-03 5 d ago also GHSA-m9cv-24rx-8mv7 , EUVD-2026-38397
- cvss
- 7.6
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 28%
- public exploits
- 0
- none known
Summary
Filament is a collection of full-stack components for accelerated Laravel development. From 3.0.0 until 3.3.53, a disabled RichEditor field rendered its raw state without sanitizing HTML. Where the data stored in this field's state isn't sanitized already when the form state was filled, an attacker could plant malicious HTML or JavaScript and achieve XSS that executes for users who view the form. This vulnerability is fixed in 3.3.53.
Patch / fix
- packagist filament/forms 3.3.53
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 4 mo ago
Exploit prediction
0.35% chance of exploitation in the next 30 days, higher than 28% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.6 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N |
| GitHub | 3.1 | 7.6 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | filament/forms | >=3.0.0, <3.3.53 |
3.3.53 |
Affected products
- filamentphp filament
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
Sources
- CVE List CVE-2026-55409
- GitHub Advisory GHSA-m9cv-24rx-8mv7
- NVD CVE-2026-55409
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.