CVE-2026-33080: Filament Unvalidated Range and Values summarizer values can be used for XSS
(updated )
Two Table summarizers (Range, Values) render raw database values without escaping HTML. If there is a lack of validation for the data in the columns that use these summarizers, an attacker could plant malicious HTML / JavaScript and achieve stored XSS that executes for users who view the table with those summarizers.
References
- github.com/advisories/GHSA-vv3x-j2x5-36jc
- github.com/filamentphp/filament/commit/efa041aeeb4b1a99acd48aaa05584993c926d1ed
- github.com/filamentphp/filament/releases/tag/v4.8.5
- github.com/filamentphp/filament/releases/tag/v5.3.5
- github.com/filamentphp/filament/security/advisories/GHSA-vv3x-j2x5-36jc
- nvd.nist.gov/vuln/detail/CVE-2026-33080
Code Behaviors & Features
Detect and mitigate CVE-2026-33080 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →