This vulnerability allows an attacker to inject malicious HTML or JavaScript into database fields that are rendered by Filament Table summarizers without escaping. The injected payload is stored persistently and executed whenever a user views the table, enabling stored XSS attacks that can compromise user sessions, exfiltrate data, or modify page content. The weakness is a lack of input validation for summarizer values, identified as CWE‑79 and CWE‑80.

The issue affects the filamentphp:filament collection of Laravel components. Versions 4.0.0 through 4.8.4 and 5.0.0 through 5.3.4 include vulnerable Range and Values summarizers. The components are used to build full‑stack admin interfaces in Laravel applications.

The CVSS score is 7.3, indicating a high severity. The EPSS score is below 1%, suggesting a low likelihood of exploitation in the wild. The vulnerability is not listed in the KEV catalog, and there is no known public exploit. The attack vector is inferred to be through any user who can view a table using the vulnerable summarizers; an attacker would first need to insert malicious data into a database column tied to those summarizers, typically via an authenticated or open input path. Once the data is stored, any subsequent viewer of the table will receive the malicious payload.