Stored XSS in parallax filament-comments

CVE-2026-90943 identifies a stored cross-site scripting (XSS) vulnerability within the parallax filament-comments package for the Filament PHP framework, affecting all versions up to and including 3.0.0. The vulnerability resides in the comment body rendering component, which fails to properly sanitize user-supplied input before displaying it in the administrative panel or public-facing views. An authenticated user can inject malicious JavaScript into a comment body. When a victim, such as an administrator with higher privileges, views the rendered comment, the malicious payload executes in their browser session. This flaw poses a significant risk to the integrity of the administrative session, potentially allowing for session token theft, unauthorized data access, or the performance of administrative actions on behalf of the victim. Defenders should prioritize updating to a patched version or implementing strict content security policies to mitigate script execution.

Impact

Successful exploitation allows for the execution of arbitrary JavaScript within the security context of a logged-in user. In an administrative panel, this facilitates account takeover via session hijacking or the unauthorized modification of system settings, impacting the confidentiality and integrity of the affected application.

Recommendation

• Upgrade the parallax filament-comments package to the latest version that includes sanitization patches for comment body rendering.
• Implement a Content Security Policy (CSP) that restricts script sources and prevents the execution of inline scripts to mitigate the impact of potential XSS vulnerabilities.
• Review administrative access logs for unusual activity associated with user accounts that have recently posted comments.