Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
4 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
The ImageColumn and ImageEntry components render raw database values without escaping HTML. Where the data passed to these components isn't validated, an attacker could plant malicious HTML or JavaScript and achieve stored XSS that executes for users who view the table or schema.
Recommended action: Upgrade to 5.6.5 or 4.11.5 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The recordSelectOptionsQuery() method may be used to scope the options available in the Select field for AttachAction and AssociateAction. However, the built-in validation rule for these fields did not apply the same scope. As a result, a user who can trigger these actions could tamper with the Livewire component's state and submit an out-of-scope value.
Recommended action: Upgrade to 3.3.51 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Two Table summarizers (Range, Values) render raw database values without escaping HTML. If there is a lack of validation for the data in the columns that use these summarizers, an attacker could plant malicious HTML / JavaScript and achieve stored XSS that executes for users who view the table with those summarizers.
Recommended action: Upgrade to 5.3.5 or 4.8.5 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
If values passed to a ColorColumn or ColumnEntry are not valid and contain a specific set of characters, applications are vulnerable to XSS attack against a user who opens a page on which a color column or entry is rendered. Versions of Filament from v3.0.0 through v3.2.114 are affected. Please upgrade to Filament v3.2.115. PoC For example, using a value such as: Would get passed into the @style() Blade directive from Laravel to render the correct background color, where $state contains the value: Since Laravel does not escape special characters within the @style Blade directive, the effective output HTML would be: Creating the opportunity for arbitrary JS to run if it was stored in the database. Response This vulnerability (in ColorColumn only) was reported by @sv-LayZ, who reported the issue and patched the issue during the evening of 25/09/2024. Thank you Mattis. The review process concluded on 27/09/2024, which revealed the issue was also present in ColorEntry. This was…
Recommended action: Upgrade to 3.2.115 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.