CVE-2026-55409

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-55409", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-16T21:48:43.124Z", "datePublished": "2026-06-22T21:47:51.607Z", "dateUpdated": "2026-11-03T19:21:15.658Z"}, "containers": {"cna": {"title": "Filament: Disabled RichEditor field state can be used for XSS", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/filamentphp/filament/security/advisories/GHSA-m9cv-24rx-8mv7", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/filamentphp/filament/security/advisories/GHSA-m9cv-24rx-8mv7"}, {"name": "https://github.com/filamentphp/filament/pull/20029", "tags": ["x_refsource_MISC"], "url": "https://github.com/filamentphp/filament/pull/20029"}, {"name": "https://github.com/filamentphp/filament/releases/tag/v3.3.53", "tags": ["x_refsource_MISC"], "url": "https://github.com/filamentphp/filament/releases/tag/v3.3.53"}], "affected": [{"vendor": "filamentphp", "product": "filament", "versions": [{"version": ">= 3.0.0, < 3.3.53", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-03T19:21:15.658Z"}, "descriptions": [{"lang": "en", "value": "Filament is a collection of full-stack components for accelerated Laravel development. From 3.0.0 until 3.3.53, a disabled RichEditor field rendered its raw state without sanitizing HTML. Where the data stored in this field's state isn't sanitized already when the form state was filled, an attacker could plant malicious HTML or JavaScript and achieve XSS that executes for users who view the form. This vulnerability is fixed in 3.3.53."}], "source": {"advisory": "GHSA-m9cv-24rx-8mv7", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-23T12:14:53.175913Z", "id": "CVE-2026-55409", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-23T12:15:00.867Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-55409", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-23T12:14:53.175913Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-23T12:14:57.504Z"}}], "cna": {"title": "Filament: Disabled RichEditor field state can be used for XSS", "source": {"advisory": "GHSA-m9cv-24rx-8mv7", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "filamentphp", "product": "filament", "versions": [{"status": "affected", "version": ">= 3.0.0, < 3.3.53"}]}], "references": [{"url": "https://github.com/filamentphp/filament/security/advisories/GHSA-m9cv-24rx-8mv7", "name": "https://github.com/filamentphp/filament/security/advisories/GHSA-m9cv-24rx-8mv7", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/filamentphp/filament/pull/20029", "name": "https://github.com/filamentphp/filament/pull/20029", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/filamentphp/filament/releases/tag/v3.3.53", "name": "https://github.com/filamentphp/filament/releases/tag/v3.3.53", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Filament is a collection of full-stack components for accelerated Laravel development. From 3.0.0 until 3.3.53, a disabled RichEditor field rendered its raw state without sanitizing HTML. Where the data stored in this field's state isn't sanitized already when the form state was filled, an attacker could plant malicious HTML or JavaScript and achieve XSS that executes for users who view the form. This vulnerability is fixed in 3.3.53."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-03T19:21:15.658Z"}}}, "cveMetadata": {"cveId": "CVE-2026-55409", "state": "PUBLISHED", "dateUpdated": "2026-11-03T19:21:15.658Z", "dateReserved": "2026-06-16T21:48:43.124Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-06-22T21:47:51.607Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "filament", "vendor": "filamentphp", "versions": [{"status": "affected", "version": ">= 3.0.0, < 3.3.53"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Filament is a collection of full-stack components for accelerated Laravel development. From 3.0.0 until 3.3.53, a disabled RichEditor field rendered its raw state without sanitizing HTML. Where the data stored in this field's state isn't sanitized already when the form state was filled, an attacker could plant malicious HTML or JavaScript and achieve XSS that executes for users who view the form. This vulnerability is fixed in 3.3.53."}, {"lang": "es", "value": "Filament es una colecci\u00f3n de componentes full-stack para el desarrollo acelerado de Laravel. Desde la versi\u00f3n 3.0.0 hasta la 3.3.53, un campo RichEditor deshabilitado renderizaba su estado sin procesar sin sanear HTML. Donde los datos almacenados en el estado de este campo no est\u00e1n ya saneados cuando se rellen\u00f3 el estado del formulario, un atacante podr\u00eda insertar HTML o JavaScript malicioso y lograr XSS que se ejecuta para los usuarios que ven el formulario. Esta vulnerabilidad se corrigi\u00f3 en la versi\u00f3n 3.3.53."}], "id": "CVE-2026-55409", "lastModified": "2026-11-03T20:18:14.493", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 4.7, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-55409", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-23T12:14:53.175913Z", "version": "2.0.3"}}]}, "published": "2026-06-22T22:16:50.533", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/filamentphp/filament/pull/20029"}, {"source": "security-advisories@github.com", "url": "https://github.com/filamentphp/filament/releases/tag/v3.3.53"}, {"source": "security-advisories@github.com", "url": "https://github.com/filamentphp/filament/security/advisories/GHSA-m9cv-24rx-8mv7"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.0.0,3.3.53)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "filament", "source": "cna", "vendor": "filamentphp"}, "product": "filament", "vendor": "filamentphp"}], "created": "2026-06-23T00:00:16.884198+00:00", "updated": "2026-06-23T01:15:16.322222+00:00", "vendors": ["filamentphp", "filamentphp$PRODUCT$filament"]}