CVE-2026-55409

Name of the Vulnerable Software and Affected Versions Filament versions 3.0.0 through 3.3.52

Description A disabled RichEditor field renders its raw state without sanitizing HTML. If the data stored in the field's state was not previously sanitized when the form state was filled, an attacker can inject malicious HTML or JavaScript. This leads to Cross-Site Scripting (XSS), which is a technique where malicious scripts are injected into trusted websites, executing in the browser of users who view the form.

Recommendations Update to version 3.3.53.