CVE-2026-55409

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-55409
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55409.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-55409
Aliases
Published
2026-06-22T21:47:51Z
Modified
2026-08-12T03:51:42Z
Severity
  • 7.6 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N CVSS Calculator
Summary
Filament: Disabled RichEditor field state can be used for XSS
Details

Filament is a collection of full-stack components for accelerated Laravel development. From 3.0.0 until 3.3.53, a disabled RichEditor field rendered its raw state without sanitizing HTML. Where the data stored in this field's state isn't sanitized already when the form state was filled, an attacker could plant malicious HTML or JavaScript and achieve XSS that executes for users who view the form. This vulnerability is fixed in 3.3.53.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55409.json"
}
References

Affected packages

Git / github.com/filamentphp/filament

Affected ranges

Type
GIT
Repo
https://github.com/filamentphp/filament
Events
Introduced
366535ae9026ef38c588ed7e697cda6492593f6f
Fixed
912ce72691b1ee74aca57909bc5bab7929547c41
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "3.0.0"
        },
        {
            "fixed": "3.3.53"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

v3.*
v3.0.0
v3.0.0-beta28
v3.0.1
v3.0.11
v3.0.12
v3.0.14
v3.0.15
v3.0.16
v3.0.19
v3.0.2
v3.0.20
v3.0.21
v3.0.22
v3.0.23
v3.0.24
v3.0.25
v3.0.26
v3.0.27
v3.0.28
v3.0.29
v3.0.3
v3.0.30
v3.0.31
v3.0.32
v3.0.33
v3.0.34
v3.0.4
v3.0.48
v3.0.49
v3.0.5
v3.0.50
v3.0.51
v3.0.52
v3.0.53
v3.0.54
v3.0.55
v3.0.56
v3.0.57
v3.0.58
v3.0.59
v3.0.6
v3.0.60
v3.0.61
v3.0.62
v3.0.63
v3.0.64
v3.0.65
v3.0.66
v3.0.67
v3.0.68
v3.0.69
v3.0.7
v3.0.70
v3.0.71
v3.0.72
v3.0.73
v3.0.74
v3.0.75
v3.0.76
v3.0.77
v3.0.78
v3.0.79
v3.0.8
v3.0.81
v3.0.82
v3.0.83
v3.0.84
v3.0.85
v3.0.86
v3.0.87
v3.0.9
v3.1.0
v3.1.0-alpha1
v3.1.0-alpha2
v3.1.0-alpha3
v3.1.0-alpha4
v3.1.1
v3.1.2
v3.1.3
v3.1.4
v3.1.5
v3.1.6
v3.1.7
v3.2.0
v3.2.1
v3.2.10
v3.2.100
v3.2.101
v3.2.102
v3.2.103
v3.2.104
v3.2.105
v3.2.106
v3.2.107
v3.2.108
v3.2.109
v3.2.11
v3.2.110
v3.2.111
v3.2.112
v3.2.113
v3.2.114
v3.2.115
v3.2.116
v3.2.117
v3.2.118
v3.2.119
v3.2.12
v3.2.120
v3.2.121
v3.2.122
v3.2.123
v3.2.124
v3.2.125
v3.2.126
v3.2.127
v3.2.128
v3.2.129
v3.2.13
v3.2.130
v3.2.131
v3.2.132
v3.2.133
v3.2.134
v3.2.135
v3.2.136
v3.2.137
v3.2.138
v3.2.139
v3.2.14
v3.2.140
v3.2.141
v3.2.142
v3.2.15
v3.2.16
v3.2.17
v3.2.18
v3.2.19
v3.2.2
v3.2.20
v3.2.21
v3.2.22
v3.2.23
v3.2.24
v3.2.25
v3.2.25-beta1
v3.2.26
v3.2.27
v3.2.28
v3.2.29
v3.2.3
v3.2.30
v3.2.31
v3.2.32
v3.2.33
v3.2.34
v3.2.35
v3.2.36
v3.2.37
v3.2.38
v3.2.4
v3.2.45
v3.2.46
v3.2.47
v3.2.48
v3.2.49
v3.2.5
v3.2.50
v3.2.57
v3.2.58
v3.2.59
v3.2.6
v3.2.60
v3.2.61
v3.2.62
v3.2.63
v3.2.64
v3.2.65
v3.2.66
v3.2.67
v3.2.68
v3.2.69
v3.2.7
v3.2.70
v3.2.71
v3.2.72
v3.2.73
v3.2.74
v3.2.75
v3.2.76
v3.2.77
v3.2.78
v3.2.79
v3.2.8
v3.2.80
v3.2.81
v3.2.82
v3.2.83
v3.2.84
v3.2.85
v3.2.86
v3.2.87
v3.2.87-beta1
v3.2.88
v3.2.9
v3.2.97
v3.2.98
v3.2.99
v3.3.0
v3.3.1
v3.3.10
v3.3.11
v3.3.12
v3.3.13
v3.3.14
v3.3.15
v3.3.16
v3.3.17
v3.3.18
v3.3.19
v3.3.2
v3.3.20
v3.3.21
v3.3.22
v3.3.23
v3.3.24
v3.3.26
v3.3.27
v3.3.28
v3.3.29
v3.3.3
v3.3.30
v3.3.31
v3.3.32
v3.3.33
v3.3.34
v3.3.35
v3.3.36
v3.3.37
v3.3.38
v3.3.39
v3.3.4
v3.3.40
v3.3.41
v3.3.42
v3.3.43
v3.3.44
v3.3.45
v3.3.46
v3.3.47
v3.3.48
v3.3.49
v3.3.5
v3.3.50
v3.3.51
v3.3.52
v3.3.6
v3.3.7
v3.3.8
v3.3.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55409.json"