---
id: "CVE-2026-55409"
kind: "vulnerability"
aliases: ["CVE-2026-55409", "GHSA-m9cv-24rx-8mv7"]
title: "Filament: Disabled RichEditor field state can be used for XSS"
severity: "high"
cvss: 7.6
epss: 0.00284
exploited: false
status: "open"
category: "package"
products: [{"name": "filament/forms", "fixed": ["3.3.53"], "affected": ">= 3.0.0, <= 3.3.52", "ecosystem": "composer"}]
ecosystems: ["composer"]
tags: ["cwe-79", "filament", "laravel", "package", "php"]
not_affected_if: ["filament-v4-or-later", "no-disabled-richeditor", "sanitized-stored-content"]
published_at: "2026-06-17T18:41:12+00:00"
first_seen_at: "2026-11-03T19:24:43+00:00"
updated_at: "2026-11-03T19:24:54+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-m9cv-24rx-8mv7", "first_seen_at": "2026-11-03T19:24:43+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55409", "first_seen_at": "2026-11-03T19:44:53+00:00"}]
---

# Filament: Disabled RichEditor field state can be used for XSS

A disabled RichEditor field in the Filament v3 forms package renders its stored state without sanitizing HTML. If that stored data was never sanitized, an attacker can plant script that runs for users who view the form.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- composer:filament/forms affected >= 3.0.0, <= 3.3.52 fixed 3.3.53

## How to check

- Check the installed version: `composer show filament/forms` and confirm whether it is between `3.0.0` and `3.3.52`.
- Look for forms that use `RichEditor` with `disabled()` and store content that users or outside sources can write to.

## Fix

- `filament/forms` fixed in `3.3.53`
- Filament v4 and above is stated not to use the affected mechanism

## Timeline

- 2026-11-03T19:24:43+00:00 ghsa https://github.com/advisories/GHSA-m9cv-24rx-8mv7
- 2026-11-03T19:44:53+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-55409

## Documents

- [advisory] Maintainer's advisory: api.github.com https://api.github.com/repos/filamentphp/filament/security-advisories/GHSA-m9cv-24rx-8mv7
- [advisory] Maintainer's advisory: github.com https://github.com/filamentphp/filament/security/advisories/GHSA-m9cv-24rx-8mv7
- [fix] Patch: github.com https://github.com/filamentphp/filament/pull/20029
- [fix] Release: github.com https://github.com/filamentphp/filament/releases/tag/v3.3.53

## From the sources

In Filament v3, a disabled `RichEditor` field rendered its raw state without sanitizing HTML. Where the data stored in this field's state isn't sanitized already when the form state was filled, an attacker could plant malicious HTML or JavaScript and achieve XSS that executes for users who view the form.

Please note that Filament v4 and above does not use the same mechanism for rendering a disabled `RichEditor` so this advisory does not apply.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_