A stored cross-site scripting vulnerability in Filament allows authenticated users to execute malicious scripts within the context of other users viewing vulnerable table components.

This is a stored cross-site scripting (XSS) flaw occurring within the Range and Values table summarizers, which fail to neutralize HTML input. An authenticated attacker can inject malicious payloads into database columns, which subsequently execute in the browser of any user viewing the affected table.

A successful exploitation of this vulnerability allows an attacker to execute arbitrary JavaScript in the context of an administrator or other privileged user. This can lead to session hijacking, unauthorized data modification, or the performace of actions on behalf of the victim. With a CVSS score of 7.3, this represents a significant risk to the integrity and confidentiality of the application environment.

Immediate Action: Update the Filament package to version 4.8.5 or 5.3.5 immediately to implement proper HTML escaping for table summarizers.

Proactive Monitoring: Review application logs for unusual input patterns in database fields, particularly those rendered within tables, and monitor for unauthorized script execution alerts.

Compensating Controls: Implement a Content Security Policy (CSP) to restrict the execution of unauthorized scripts and utilize a Web Application Firewall to block common XSS injection patterns.

Public Exploit Available: Unknown.

Given the potential for privilege escalation via session theft, it is critical that organizations prioritize this update. Administrators should verify their current version of Filament and apply the provided patches in all development, staging, and production environments as soon as possible to mitigate the risk of stored XSS attacks.