# Stored XSS in parallax/filament-comments

- **Reference**: HI-SA-2026-001
- **Type**: Vulnerability
- **Severity**: Critical
- **Platform**: Packagist
- **Package**: parallax/filament-comments
- **Affected versions**: <= 3.0.0
- **CVE**: CVE-2026-90943
- **CWE**: CWE-79: Cross-site scripting
- **CVSS 4.0**: 9.3 (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N)
- **CVSS 3.1**: 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
- **Researched by**: [Joshua van der Poll](https://hackindex.nl/en/author/joshua-van-der-poll)

In parallax/filament-comments up to and including 3.0.0, comments reach the page without escaping. Any signed-in user of the Filament panel can put code in a comment that runs in the browser of everyone who views the comments, admins included. HackIndex reported it in July 2026 with a proposed patch. The maintainer did not respond, so CVE-2026-90943 was requested through VulnCheck. There is no patched version yet.

## Who it affects

- Sites with a Filament panel running parallax/filament-comments up to and including 3.0.0
- Filament 3 with package version 1.x: vulnerable in the default install
- Filament 4 and 5 with package version 2.x or 3.x: vulnerable when the markdown editor is enabled
- Panels where more users than just admins can post comments

## How to fix it

There is no patched version yet. Until there is, limit who may post comments with your own policy instead of the bundled one, which allows everyone. On Filament 4 and 5, use the rich editor instead of the markdown editor, it cleans input on the server. Or remove the package until a fix is out.

## Timeline

- 2026-07-21: Reported to Parallax through a GitHub Security Advisory, with a proposed patch
- 2026-08-04: Reminder sent, no response
- 2026-08-29: Second reminder on GitHub and by email, no response
- 2026-09-11: Third reminder to all maintainers, no response
- 2026-09-12: Reported to VulnCheck as CVE numbering authority
- 2026-09-14: CVE-2026-90943 published by VulnCheck

## References

- [CVE-2026-90943 (NVD)](https://nvd.nist.gov/vuln/detail/CVE-2026-90943)
- [VulnCheck advisory](https://www.vulncheck.com/advisories/parallax-filament-comments-through-3.0.0-stored-xss-via-comment-body)
- [Package on Packagist](https://packagist.org/packages/parallax/filament-comments)

## About this report

HackIndex does pentests and code review, and researches open-source packages, plugins and extensions. A vulnerability goes to the maker first, malware straight to the platform that spreads it.

Questions about this report or a correction? Mail the address in security.txt with HI-SA-2026-001 in the subject.

You may reuse this report under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), with the reference and this URL as source.

- [Why HackIndex does research](https://hackindex.nl/en/research)
- [Deadlines and agreements](https://hackindex.nl/en/security)
- [security.txt](https://hackindex.nl/.well-known/security.txt)

Source: https://hackindex.nl/en/research/hi-sa-2026-001