CVE-2026-90943

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-90943

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90943.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-90943

Published

2026-09-14T15:37:31Z

Modified

2026-09-15T11:30:56Z

Severity

9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N CVSS Calculator

Summary

parallax filament-comments through 3.0.0 Stored XSS via Comment Body

Details

parallax filament-comments through 3.0.0 contains a stored cross-site scripting vulnerability in comment body rendering that allows authenticated panel users to inject malicious scripts. Attackers can store XSS payloads in comment bodies that execute in the browsers of other users viewing those comments, including administrators, enabling session token theft and unauthorized actions.

Database specific

{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90943.json"
}

References

Affected packages

Git / github.com/parallax/filament-comments

Affected ranges

Type

GIT

Repo

https://github.com/parallax/filament-comments

Events

Introduced

Last Affected

4e9a49edb2c995e1ad87f0f2c760bdbadfe50d2c

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "3.0.0"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

1.*

1.0.0

1.0.1

1.0.2

1.0.3

1.1.0

1.2.0

1.3.0

1.3.1

1.4.0

1.5.0

1.5.1

2.*

2.0.0

3.*

3.0.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90943.json"