HI-SA-2026-001 Critical Published CVE-2026-90943
Stored XSS in parallax/filament-comments
In parallax/filament-comments up to and including 3.0.0, comments reach the page without escaping. Any signed-in user of the Filament panel can put code in a comment that runs in the browser of everyone who views the comments, admins included. HackIndex reported it in July 2026 with a proposed patch. The maintainer did not respond, so CVE-2026-90943 was requested through VulnCheck. There is no patched version yet.
Who it affects
- Sites with a Filament panel running parallax/filament-comments up to and including 3.0.0
- Filament 3 with package version 1.x: vulnerable in the default install
- Filament 4 and 5 with package version 2.x or 3.x: vulnerable when the markdown editor is enabled
- Panels where more users than just admins can post comments
How to fix it
There is no patched version yet. Until there is, limit who may post comments with your own policy instead of the bundled one, which allows everyone. On Filament 4 and 5, use the rich editor instead of the markdown editor, it cleans input on the server. Or remove the package until a fix is out.
Timeline
- Reported to Parallax through a GitHub Security Advisory, with a proposed patch
- Reminder sent, no response 14 days
- Second reminder on GitHub and by email, no response 39 days
- Third reminder to all maintainers, no response 52 days
- Reported to VulnCheck as CVE numbering authority 53 days
- CVE-2026-90943 published by VulnCheck 55 days
References
- CVE-2026-90943 (NVD) (opens in a new tab) nvd.nist.gov
- VulnCheck advisory (opens in a new tab) www.vulncheck.com
- Package on Packagist (opens in a new tab) packagist.org
About this report
HackIndex does pentests and code review, and researches open-source packages, plugins and extensions. A vulnerability goes to the maker first, malware straight to the platform that spreads it.
Questions about this report or a correction? Mail info [at] hackindex [dot] nl with HI‑SA‑2026‑001 in the subject.
You may reuse this report under CC BY 4.0 (opens in a new tab), with the reference and this URL as source.
Why HackIndex does research Deadlines and agreements About HackIndex
Have it checked
Flaws like this often sit in the way an app uses a package. A security code review looks at that on purpose.