{ "affected": [ { "database_specific": { "last_known_affected_version_range": "<= 3.3.52", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-m9cv-24rx-8mv7/GHSA-m9cv-24rx-8mv7.json" }, "package": { "ecosystem": "Packagist", "name": "filament/forms", "purl": "pkg:composer/filament/forms" }, "ranges": [ { "events": [ { "introduced": "3.0.0" }, { "fixed": "3.3.53" } ], "type": "ECOSYSTEM" } ], "versions": [ "v3.0.0", "v3.0.1", "v3.0.10", "v3.0.100", "v3.0.101", "v3.0.102", "v3.0.103", "v3.0.11", "v3.0.12", "v3.0.13", "v3.0.14", "v3.0.15", "v3.0.16", "v3.0.17", "v3.0.18", "v3.0.19", "v3.0.2", "v3.0.20", "v3.0.21", "v3.0.22", "v3.0.23", "v3.0.24", "v3.0.25", "v3.0.26", "v3.0.27", "v3.0.28", "v3.0.29", "v3.0.3", "v3.0.30", "v3.0.31", "v3.0.32", "v3.0.33", "v3.0.34", "v3.0.35", "v3.0.36", "v3.0.37", "v3.0.38", "v3.0.39", "v3.0.4", "v3.0.40", "v3.0.41", "v3.0.42", "v3.0.43", "v3.0.44", "v3.0.45", "v3.0.46", "v3.0.47", "v3.0.48", "v3.0.49", "v3.0.5", "v3.0.50", "v3.0.51", "v3.0.52", "v3.0.53", "v3.0.54", "v3.0.55", "v3.0.56", "v3.0.57", "v3.0.58", "v3.0.59", "v3.0.6", "v3.0.60", "v3.0.61", "v3.0.62", "v3.0.63", "v3.0.64", "v3.0.65", "v3.0.66", "v3.0.67", "v3.0.68", "v3.0.69", "v3.0.7", "v3.0.70", "v3.0.71", "v3.0.72", "v3.0.73", "v3.0.74", "v3.0.75", "v3.0.76", "v3.0.77", "v3.0.78", "v3.0.79", "v3.0.8", "v3.0.80", "v3.0.81", "v3.0.82", "v3.0.83", "v3.0.84", "v3.0.85", "v3.0.86", "v3.0.87", "v3.0.88", "v3.0.89", "v3.0.9", "v3.0.90", "v3.0.91", "v3.0.92", "v3.0.93", "v3.0.94", "v3.0.95", "v3.0.96", "v3.0.97", "v3.0.98", "v3.0.99", "v3.1.0", "v3.1.0-alpha1", "v3.1.0-alpha2", "v3.1.0-alpha3", "v3.1.0-alpha4", "v3.1.1", "v3.1.10", "v3.1.11", "v3.1.12", "v3.1.13", "v3.1.14", "v3.1.15", "v3.1.16", "v3.1.17", "v3.1.18", "v3.1.19", "v3.1.2", "v3.1.20", "v3.1.21", "v3.1.22", "v3.1.23", "v3.1.24", "v3.1.25", "v3.1.26", "v3.1.27", "v3.1.28", "v3.1.29", "v3.1.3", "v3.1.30", "v3.1.31", "v3.1.32", "v3.1.33", "v3.1.34", "v3.1.35", "v3.1.36", "v3.1.37", "v3.1.38", "v3.1.39", "v3.1.4", "v3.1.40", "v3.1.41", "v3.1.42", "v3.1.43", "v3.1.44", "v3.1.45", "v3.1.46", "v3.1.47", "v3.1.5", "v3.1.6", "v3.1.7", "v3.1.8", "v3.1.9", "v3.2.0", "v3.2.1", "v3.2.10", "v3.2.100", "v3.2.101", "v3.2.102", "v3.2.103", "v3.2.104", "v3.2.105", "v3.2.106", "v3.2.107", "v3.2.108", "v3.2.109", "v3.2.11", "v3.2.110", "v3.2.111", "v3.2.112", "v3.2.113", "v3.2.114", "v3.2.115", "v3.2.116", "v3.2.117", "v3.2.118", "v3.2.119", "v3.2.12", "v3.2.120", "v3.2.121", "v3.2.122", "v3.2.123", "v3.2.124", "v3.2.125", "v3.2.126", "v3.2.127", "v3.2.128", "v3.2.129", "v3.2.13", "v3.2.130", "v3.2.131", "v3.2.132", "v3.2.133", "v3.2.134", "v3.2.135", "v3.2.136", "v3.2.137", "v3.2.138", "v3.2.139", "v3.2.14", "v3.2.140", "v3.2.141", "v3.2.142", "v3.2.15", "v3.2.16", "v3.2.17", "v3.2.18", "v3.2.19", "v3.2.2", "v3.2.20", "v3.2.21", "v3.2.22", "v3.2.23", "v3.2.24", "v3.2.25", "v3.2.25-beta1", "v3.2.26", "v3.2.27", "v3.2.28", "v3.2.29", "v3.2.3", "v3.2.30", "v3.2.31", "v3.2.32", "v3.2.33", "v3.2.34", "v3.2.35", "v3.2.36", "v3.2.37", "v3.2.38", "v3.2.39", "v3.2.4", "v3.2.40", "v3.2.41", "v3.2.42", "v3.2.43", "v3.2.44", "v3.2.45", "v3.2.46", "v3.2.47", "v3.2.48", "v3.2.49", "v3.2.5", "v3.2.50", "v3.2.51", "v3.2.52", "v3.2.53", "v3.2.54", "v3.2.55", "v3.2.56", "v3.2.57", "v3.2.58", "v3.2.59", "v3.2.6", "v3.2.60", "v3.2.61", "v3.2.62", "v3.2.63", "v3.2.64", "v3.2.65", "v3.2.66", "v3.2.67", "v3.2.68", "v3.2.69", "v3.2.7", "v3.2.70", "v3.2.71", "v3.2.72", "v3.2.73", "v3.2.74", "v3.2.75", "v3.2.76", "v3.2.77", "v3.2.78", "v3.2.79", "v3.2.8", "v3.2.80", "v3.2.81", "v3.2.82", "v3.2.83", "v3.2.84", "v3.2.85", "v3.2.86", "v3.2.87", "v3.2.87-beta1", "v3.2.88", "v3.2.89", "v3.2.9", "v3.2.90", "v3.2.91", "v3.2.92", "v3.2.93", "v3.2.94", "v3.2.95", "v3.2.96", "v3.2.97", "v3.2.98", "v3.2.99", "v3.3.0", "v3.3.1", "v3.3.10", "v3.3.11", "v3.3.12", "v3.3.13", "v3.3.14", "v3.3.15", "v3.3.16", "v3.3.17", "v3.3.18", "v3.3.19", "v3.3.2", "v3.3.20", "v3.3.21", "v3.3.22", "v3.3.23", "v3.3.24", "v3.3.25", "v3.3.26", "v3.3.27", "v3.3.28", "v3.3.29", "v3.3.3", "v3.3.30", "v3.3.31", "v3.3.32", "v3.3.33", "v3.3.34", "v3.3.35", "v3.3.36", "v3.3.37", "v3.3.38", "v3.3.39", "v3.3.4", "v3.3.40", "v3.3.41", "v3.3.42", "v3.3.43", "v3.3.45", "v3.3.46", "v3.3.47", "v3.3.48", "v3.3.49", "v3.3.5", "v3.3.50", "v3.3.51", "v3.3.52", "v3.3.6", "v3.3.7", "v3.3.8", "v3.3.9" ] } ], "aliases": [ "CVE-2026-55409" ], "database_specific": { "cwe_ids": [ "CWE-79" ], "github_reviewed": true, "github_reviewed_at": "2026-06-17T18:41:12Z", "nvd_published_at": "2026-06-22T22:16:50Z", "severity": "HIGH" }, "details": "In Filament v3, a disabled `RichEditor` field rendered its raw state without sanitizing HTML. Where the data stored in this field's state isn't sanitized already when the form state was filled, an attacker could plant malicious HTML or JavaScript and achieve XSS that executes for users who view the form.\n\nPlease note that Filament v4 and above does not use the same mechanism for rendering a disabled `RichEditor` so this advisory does not apply.", "id": "GHSA-m9cv-24rx-8mv7", "modified": "2026-11-03T19:30:08.313336367Z", "published": "2026-06-17T18:41:12Z", "references": [ { "type": "WEB", "url": "https://github.com/filamentphp/filament/security/advisories/GHSA-m9cv-24rx-8mv7" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55409" }, { "type": "WEB", "url": "https://github.com/filamentphp/filament/pull/20029" }, { "type": "PACKAGE", "url": "https://github.com/filamentphp/filament" }, { "type": "WEB", "url": "https://github.com/filamentphp/filament/releases/tag/v3.3.53" } ], "schema_version": "1.9.2", "severity": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N", "type": "CVSS_V3" } ], "summary": "Filament: Disabled RichEditor field state can be used for XSS" }