Live › vulnerability › CVE-2026-55409
A disabled RichEditor field in the Filament v3 forms package renders its stored state without sanitizing HTML. If that stored data was never sanitized, an attacker can plant script that runs for users who view the form.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 19:24 UTC, 0h before NVD. All times on this page are UTC.
Applications on Filament v3 that render a disabled RichEditor field whose stored content was not sanitized when the form state was filled. Filament v4 and above are stated not to be affected by this mechanism. Apps without disabled RichEditor fields on user-writable data are less exposed.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| filament/forms | composer | >= 3.0.0, <= 3.3.52 | 3.3.53 |
composer show filament/forms and confirm whether it is between 3.0.0 and 3.3.52.RichEditor with disabled() and store content that users or outside sources can write to.filament/forms fixed in 3.3.53Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In Filament v3, a disabled RichEditor field rendered its raw state without sanitizing HTML. Where the data stored in this field's state isn't sanitized already when the form state was filled, an attacker could plant malicious HTML or JavaScript and achieve XSS that executes for users who view the form.
Please note that Filament v4 and above does not use the same mechanism for rendering a disabled RichEditor so this advisory does not apply.
This page as .md · .json · in your agent: get_signal("CVE-2026-55409")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.