Description

parallax filament-comments through 3.0.0 contains a stored cross-site scripting vulnerability in comment body rendering that allows authenticated panel users to inject malicious scripts. Attackers can store XSS payloads in comment bodies that execute in the browsers of other users viewing those comments, including administrators, enabling session token theft and unauthorized actions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.7",
  "pubDate": "2026-09-14T16:17:41.693Z",
  "pubdate": "2026-09-14T16:17:41.693Z",
  "executiveSummary": "The filament-comments package, up to and including version 3.0.0, is susceptible to a stored cross-site scripting (XSS) vulnerability residing within its comment body rendering mechanism.\nThis vulnerability allows authenticated users with access to the panel interface to inject and persist malicious JavaScript payloads into comment content.\nThe primary impact involves the execution of arbitrary scripts in the browsers of victim users, including those with administrative privileges, whenever they view the compromised comment.\nSuccessful exploitation facilitates unauthorized actions, such as session hijacking via session token theft, data exfiltration, or the modification of application state under the context of the victim's session.\nThis represents a significant security risk for applications utilizing filament-comments, as it effectively bridges the gap between an authenticated user and an administrative compromise.\nThe vulnerability requires an attacker to possess authentication that permits access to the commenting panel, after which the malicious payload is stored server-side and rendered client-side without adequate sanitization.",
  "technicalDetails": "The vulnerability stems from improper neutralization of user-supplied input during the rendering phase of comment bodies in the filament-comments package (up to 3.0.0).\nThe root cause is the failure to employ robust output encoding or sanitization processes when the application retrieves stored comment data from the database and injects it into the Document Object Model (DOM).\nBecause the application treats the stored comment body as trusted content, any injected HTML tags or JavaScript event handlers (e.g., <script>, onload, onerror) are parsed and executed by the browser of any user viewing the comment.\nThe exploitation flow begins with an authenticated attacker submitting a crafted comment containing a malicious script payload through the designated comment submission interface.\nUpon submission, the filament-comments component saves this payload directly into the underlying database without structural filtering or encoding.\nWhen an administrator or another user subsequently navigates to the view containing the comment, the application fetches the raw, malicious string from the database and renders it within the page's HTML context.\nThe victim's browser, encountering the injected script, executes the code within the origin of the application. This provides the attacker with a bridge to execute arbitrary commands in the victim's session.\nIn a post-exploitation scenario, the script can be configured to capture cookies (if not marked HttpOnly), perform background requests to the server (Cross-Site Request Forgery), or redirect the victim to an attacker-controlled resource.\nSince the payload is persistent, the script will re-execute every time the affected page is loaded by any user, maximizing the potential impact across the user base.\nThis vulnerability is classified as Stored XSS because the malicious data is saved permanently on the server side, resulting in a continuous threat to any user interacting with the comment section."
}