CVE-2026-90943

Parallax filament-comments through 3.0.0 contains a stored cross-site scripting (XSS) flaw in how comment bodies are rendered within Filament admin panels. An attacker with any authenticated panel account can post a comment containing a malicious script; when another user, including an administrator, views that comment, the script executes in their browser. Successful exploitation enables session token theft and unauthorized actions taken as the victim, which is why the issue is rated critical (CVSS 4.0: 9.3) despite requiring authenticated access and victim interaction. All deployments of filament-comments at or below version 3.0.0 are affected. There is no known public proof of concept and the flaw is not listed in CISA's Known Exploited Vulnerabilities catalog, so exploitation is presumed not yet observed.

What to do: Upgrade filament-comments to a release newer than 3.0.0 as soon as the vendor ships a fix, and check the Parallax/Filament plugin advisory for the patched version. Until then, restrict which panel roles can post comments, audit existing comment records for injected script payloads, and consider a Content-Security-Policy header on panel routes to blunt script execution. If a malicious comment is found, remove it, inspect admin session/account activity for compromise, and rotate panel sessions and credentials.