An XSS vulnerability in Filament occurs when a disabled RichEditor field renders raw, unsanitized HTML. If an attacker can insert malicious HTML or JavaScript into the field’s stored state, the code will execute in the browsers of any users who view the form. This flaw allows arbitrary script execution on the client side, potentially compromising confidentiality and integrity of form data for all viewers.

Filament PHP’s Filament package, versions 3.0.0 through 3.3.53, used in Laravel applications. The issue is resolved in 3.3.53 and later.

The CVSS score is 7.6, indicating high severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, suggesting no currently known active exploitation. The most likely attack vector involves a web-based exploitation where an attacker injects malicious content into the RichEditor before the form is rendered, forcing it to be exposed to other users.