CVE-2026-90943: Filament Comments Stored XSS Vulnerability

CVE-2026-90943 Overview

CVE-2026-90943 is a stored cross-site scripting vulnerability [CWE-79] in the parallax/filament-comments package through version 3.0.0. The flaw exists in the comment body rendering logic inside the Blade template resources/views/comments.blade.php, which fails to properly escape user-supplied content. Authenticated panel users can inject JavaScript payloads into comment bodies. When other panel users, including administrators, view the affected comments, the payloads execute in their browser context. This enables session token theft, unauthorized actions on behalf of victims, and privilege escalation within the Filament admin panel.

Critical Impact
Authenticated attackers can persist JavaScript in comments that executes against administrators, leading to account takeover and unauthorized administrative actions.

Affected Products

parallax/filament-comments versions up to and including 3.0.0
Laravel Filament admin panels that install the vulnerable package via Composer
Applications distributed through the Packagist parallax/filament-comments package

Discovery Timeline

2026-09-14 - CVE-2026-90943 published to the National Vulnerability Database
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-90943

Vulnerability Analysis

The vulnerability resides in how the Filament Comments package renders stored comment bodies inside the admin panel. The Blade template outputs comment content without applying the default Blade escaping directive, allowing raw HTML and JavaScript to reach the DOM. Because comments are persisted in the database and rendered whenever a user views the comment thread, the payload executes for every subsequent viewer.

Exploitation requires only low-privileged authenticated access to the Filament panel and passive user interaction, such as browsing to a page that displays the comment. The FilamentCommentPolicy grants comment creation broadly to authenticated panel users, expanding the pool of potential attackers. Because Filament administrators typically hold elevated privileges within the host application, a stolen administrator session can be pivoted into full application compromise.

Root Cause

The root cause is unescaped output of user-controlled comment bodies in the Blade view. Blade templates escape variables by default when the {{ }} syntax is used, but the vulnerable template renders comment HTML through an unescaped construct ({!! !!} or equivalent raw output), bypassing the framework's built-in XSS mitigation. No server-side sanitization or HTML allow-list filtering is applied before persistence or rendering. Review the GitHub Blade Template File and GitHub Comment Policy File for the affected source.

Attack Vector

An authenticated attacker submits a comment containing a JavaScript payload embedded in an HTML element, such as an <img> tag with an onerror handler or a <script> block. The payload is stored in the comments table without sanitization. When a victim, typically an administrator reviewing panel activity, loads the page rendering that comment, the browser parses and executes the injected script. The script runs with the victim's session cookies and CSRF tokens, enabling exfiltration of credentials or execution of state-changing requests. Additional context is available in the HackIndex Stored XSS Research and the VulnCheck Advisory on XSS.

Detection Methods for CVE-2026-90943

Indicators of Compromise

Comment records in the Filament comments table containing HTML tags such as <script>, <img onerror=>, <svg onload=>, or JavaScript URI schemes.
Outbound HTTP requests from administrator browser sessions to unfamiliar domains shortly after viewing panel comment threads.
Unexpected administrative actions or configuration changes originating from valid admin sessions with no corresponding user activity in application audit logs.

Detection Strategies

Query the comments database table for payload patterns using regular expressions targeting HTML event handlers and script tags.
Enable and monitor Content Security Policy (CSP) violation reports for the Filament panel routes to surface inline script execution attempts.
Review web server and application logs for POST requests to comment endpoints that contain URL-encoded HTML markup in the body.

Monitoring Recommendations

Alert on new panel user accounts creating comments within a short interval of registration, which may indicate reconnaissance and payload staging.
Track browser-side errors and CSP reports from authenticated admin sessions and correlate them with recent comment activity.
Baseline administrator API activity and flag session-driven actions that deviate from established behavioral patterns.

How to Mitigate CVE-2026-90943

Immediate Actions Required

Upgrade parallax/filament-comments to a fixed release beyond 3.0.0 as soon as one is published on Packagist Filament Comments Package.
Audit the comments table for any stored payloads containing HTML or JavaScript and purge or sanitize affected rows.
Rotate session identifiers and revoke API tokens for any administrator who may have viewed malicious comments.

Patch Information

At the time of publication, no fixed version has been indicated in the referenced advisories. Monitor the VulnCheck Advisory on XSS and the upstream repository for release announcements. Until a patched release is available, apply the workarounds below.

Workarounds

Fork the package and modify resources/views/comments.blade.php to render comment bodies with Blade's escaped {{ }} syntax, or apply an HTML sanitizer such as HTMLPurifier before display.
Restrict the FilamentCommentPolicy so that comment creation is limited to a small set of trusted roles rather than all authenticated panel users.
Deploy a strict Content Security Policy on Filament panel routes that disallows inline scripts and restricts script sources to trusted origins.

bash

# Configuration example: enforce a restrictive CSP header for Filament panel routes
# Add to your Laravel middleware to reduce XSS impact until a patched release is available
header("Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'");