CVE-2026-90943: stored XSS via admin panel

CISO Take

A stored cross-site scripting flaw in the parallax/filament-comments Laravel package (≤3.0.0) lets any authenticated low-privilege panel user embed a malicious script in a comment body that silently executes in the browser of anyone who later views it, including administrators. There is no CISA KEV listing, no published PoC or Nuclei template, and no EPSS score, so there's no evidence of active exploitation — but the vulnerability itself requires no special skill to weaponize (classic unsanitized Blade rendering), and the CVSS 8.7 score with scope-change (S:C) reflects that a low-privileged insider can pivot to admin-level session hijacking with a single click from the victim. Because this affects a Filament-based admin/ops panel (categorized here as ml_ui), the realistic blast radius is any internal dashboard used to review, approve, or annotate AI/ML artifacts — model deployments, dataset notes, or pipeline configs — where an admin's stolen session could be used to make unauthorized changes. Patch to a fixed release above 3.0.0 (or apply output escaping to the comment rendering view) immediately, since this is a trivial insider-threat vector with no current detection signal to rely on in the meantime.

Sources: NVD VulnCheck ATLAS

What is the risk?

High severity but currently low observed exploitation signal: CVSS 3.1 base score 8.7 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) reflects low attack complexity and a scope change from a low-privileged comment author to a higher-privileged viewer, but exploitation requires user interaction (a privileged user must open the comment) and there is no EPSS score, no CISA KEV entry, no public PoC, and no Nuclei template, meaning exploitation-in-the-wild data is absent rather than reassuring. The attack pattern (stored XSS in a comment field) is a well-understood, trivially reproducible class of bug, so the real risk driver is whether the organization exposes this Filament panel to untrusted or semi-trusted internal/external users who can author comments.

How does the attack unfold?

Initial Access

A low-privileged authenticated user with comment permissions submits a stored XSS payload in a comment body on the Filament admin panel.

AML.T0049

Execution

A higher-privileged user (e.g., ML ops admin) views the comment thread and the malicious script executes in their authenticated browser session.

Credential Access

The script exfiltrates the victim's session token/cookie to an attacker-controlled endpoint.

Impact

The attacker replays the stolen session to act with admin privileges in the panel, potentially altering AI/ML pipeline configuration, approvals, or exposed data.

Initial Access

A low-privileged authenticated user with comment permissions submits a stored XSS payload in a comment body on the Filament admin panel.

AML.T0049

Execution

A higher-privileged user (e.g., ML ops admin) views the comment thread and the malicious script executes in their authenticated browser session.

Credential Access

The script exfiltrates the victim's session token/cookie to an attacker-controlled endpoint.

Impact

The attacker replays the stolen session to act with admin privileges in the panel, potentially altering AI/ML pipeline configuration, approvals, or exposed data.

How severe is it?

CVSS 3.1

8.7 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 15% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR Low

UI Required

S Changed

C High

I High

A None

What should I do?

1 step

Upgrade parallax/filament-comments past 3.0.0 once a patched release is available, or apply an interim fix by ensuring comments.blade.php uses escaped output ({{ }}) rather than raw/unescaped rendering ({!! !!}) for comment bodies. Deploy a restrictive Content-Security-Policy to blunt inline script execution as defense-in-depth. Review FilamentCommentPolicy to tighten who can author comments (least privilege), enforce HttpOnly/Secure/SameSite session cookies to limit token theft impact, and rotate admin sessions after upgrading. Monitor admin/ops panel audit logs for unexpected actions immediately following comment views, since no scanner signature or KEV alerting currently exists for this CVE.

How is it classified?

Auth Bypass Data Leakage Framework Plugin AML.T0049 - Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.6 - AI system security controls

NIST AI RMF

MANAGE-4.1 - Risk monitoring for deployed AI systems

Frequently Asked Questions

What is CVE-2026-90943?

A stored cross-site scripting flaw in the parallax/filament-comments Laravel package (≤3.0.0) lets any authenticated low-privilege panel user embed a malicious script in a comment body that silently executes in the browser of anyone who later views it, including administrators. There is no CISA KEV listing, no published PoC or Nuclei template, and no EPSS score, so there's no evidence of active exploitation — but the vulnerability itself requires no special skill to weaponize (classic unsanitized Blade rendering), and the CVSS 8.7 score with scope-change (S:C) reflects that a low-privileged insider can pivot to admin-level session hijacking with a single click from the victim. Because this affects a Filament-based admin/ops panel (categorized here as ml_ui), the realistic blast radius is any internal dashboard used to review, approve, or annotate AI/ML artifacts — model deployments, dataset notes, or pipeline configs — where an admin's stolen session could be used to make unauthorized changes. Patch to a fixed release above 3.0.0 (or apply output escaping to the comment rendering view) immediately, since this is a trivial insider-threat vector with no current detection signal to rely on in the meantime.

Is CVE-2026-90943 actively exploited?

No confirmed active exploitation of CVE-2026-90943 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-90943?

Upgrade parallax/filament-comments past 3.0.0 once a patched release is available, or apply an interim fix by ensuring comments.blade.php uses escaped output ({{ }}) rather than raw/unescaped rendering ({!! !!}) for comment bodies. Deploy a restrictive Content-Security-Policy to blunt inline script execution as defense-in-depth. Review FilamentCommentPolicy to tighten who can author comments (least privilege), enforce HttpOnly/Secure/SameSite session cookies to limit token theft impact, and rotate admin sessions after upgrading. Monitor admin/ops panel audit logs for unexpected actions immediately following comment views, since no scanner signature or KEV alerting currently exists for this CVE.

What systems are affected by CVE-2026-90943?

This vulnerability affects the following AI/ML architecture patterns: ml_ui / ops dashboards, model review and approval panels, admin tooling for ML pipeline management.

What is the CVSS score for CVE-2026-90943?

CVE-2026-90943 has a CVSS v3.1 base score of 8.7 (HIGH). The EPSS exploitation probability is 0.24%.

What is the AI security impact?

Affected AI Architectures

ml_ui / ops dashboardsmodel review and approval panelsadmin tooling for ML pipeline management

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

Compliance Controls Affected

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE-4.1

What are the technical details?

Original Advisory

parallax filament-comments through 3.0.0 contains a stored cross-site scripting vulnerability in comment body rendering that allows authenticated panel users to inject malicious scripts. Attackers can store XSS payloads in comment bodies that execute in the browsers of other users viewing those comments, including administrators, enabling session token theft and unauthorized actions.

Exploitation Scenario

A low-privileged user with comment-posting access to a Filament-based ML operations dashboard (e.g., a portal used to annotate training data or approve model deployments) submits a comment containing a hidden <script> payload. An administrator or ML ops lead later opens the comment thread to review feedback; the payload executes silently in their authenticated browser session, exfiltrating their Filament session cookie to an attacker-controlled endpoint. The attacker replays that session to access the panel with the admin's privileges — potentially approving a malicious model deployment, altering pipeline configuration, or exporting sensitive dataset annotations — all logged as actions performed by the legitimate administrator.

Weaknesses (CWE)

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Primary CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

[Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. Examples of libraries and frameworks that make it easier to generate properly encoded output include Microsoft's Anti-XSS library, the OWASP ESAPI Encoding module, and Apache Wicket.
[Implementation, Architecture and Design] Understand the context in which your data will be used and the encoding that will be expected. This is especially important when transmitting data between different components, or when generating outputs that can contain multiple encodings at the same time, such as web pages or multi-part mail messages. Study all expected communication protocols and data representations to determine the required encoding strategies. For any data that will be output to another web page, especially any data that was received from external inputs, use the appropriate encoding on all non-alphanumeric characters. Parts of the same output document may require different encodings, which will vary depending on whether the output is in the: etc. Note that HTML Entity Encoding is only appropriate for the HTML body. Consult the XSS Prevention Cheat Sheet [REF-724] for more details on the types of encoding and escaping that are needed. HTML body Element attributes (such as src="XYZ") URIs JavaScript sections Casca

Source: MITRE CWE corpus.