CVE-2026-90943: parallax filament-comments through 3.0.0 Stored XSS via Comment Body
parallax filament-comments through 3.0.0 contains a stored cross-site scripting vulnerability in comment body rendering that allows authenticated panel users to inject malicious scripts. Attackers can store XSS payloads in comment bodies that execute in the browsers of other users viewing those comments, including administrators, enabling session token theft and unauthorized actions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
parallax filament-commentsto a version that resolves this vulnerability.Fixed in 3.0.0 - Compensating control
Mitigate the stored XSS risk by preventing execution of injected scripts in comment rendering (e.g., enforce output encoding/sanitization for comment body before it is rendered to browsers of other users, including administrators).
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated panel user who can submit a comment body can store a malicious script. The payload executes when another user views the affected comment, including an administrator.
What is the likely impact if an administrator views a malicious comment?
The attacker may be able to steal the administrator's session token or perform unauthorized actions in that administrator's browser context. Availability impact is not indicated by the supplied vector.
Which versions are known to be affected?
The issue is reported in parallax/filament-comments through version 3.0.0. No fixed version is provided in the available data.