Filament: Unvalidated Range and Values summarizer values can be used for XSS

An attacker can leverage this XSS vulnerability to inject arbitrary JavaScript code into the Filament Table component. This code could be used to steal user session cookies, redirect users to malicious websites, deface the application, or perform other actions on behalf of the user. The stored nature of the XSS means the malicious script persists until the data is updated or the vulnerable component is patched. Successful exploitation requires the attacker to control the data displayed in a column utilizing the vulnerable Range or Values summarizer, allowing them to inject the malicious HTML payload. The blast radius extends to all users who view the affected table, potentially compromising sensitive data and application functionality.

Laravel applications utilizing Filament versions 4.0.0 through 5.3.4 are at risk. Specifically, applications that display user-controlled data in Filament Table components using the Range or Values summarizers are particularly vulnerable. Shared hosting environments where multiple Laravel applications share the same server resources could also be impacted if one application is vulnerable and can inject malicious code that affects other applications.

• laravel / wordpress: Examine Filament Table components for suspicious HTML or JavaScript code. Review application logs for unusual activity related to table rendering. • generic web: Use curl/wget to inspect the rendered HTML of Filament tables, looking for injected script tags or event handlers.

curl 'https://your-laravel-app.com/filament/table' | grep -i '<script>' 

1. 2026-03-20Disclosure

   disclosure

1. Reserviert2026-03-17
2. Veröffentlicht2026-03-20
3. Geändert2026-03-25
4. EPSS aktualisiert2026-03-27

The primary mitigation for CVE-2026-33080 is to upgrade to Filament version 4.8.5 or 5.3.5, which contain the necessary fixes. If immediate upgrading is not feasible, consider implementing input validation on the database columns used in the Range and Values summarizers to sanitize potentially malicious HTML. As a temporary workaround, consider disabling the Range and Values summarizers until a proper upgrade can be performed. Web application firewalls (WAFs) configured to detect and block XSS payloads can also provide a layer of defense, but should not be relied upon as the sole mitigation.