Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability, identified as GHSA-m9cv-24rx-8mv7, is a stored Cross-Site Scripting (XSS) issue in the RichEditor component of the filament/forms package. The root cause of the vulnerability lies in the rendering of the component's state when it is in a disabled state.
Analysis of the patch in commit b0f6730199bd8a1283f2584cdd977bef7ebd7ac9 reveals that the Blade template packages/forms/resources/views/components/rich-editor.blade.php was modified. The vulnerable version of the code used the x-html directive from Alpine.js to display the editor's content. This directive renders raw HTML, and since the content of the RichEditor can be controlled by a user, it was possible to inject malicious scripts.
The fix involves removing the x-html directive and instead using Laravel Blade's raw output syntax ({!! ... !!}) combined with a new call to a sanitizeHtml() method on the component's state. This ensures that any potentially malicious HTML is sanitized before being rendered, thus mitigating the XSS vulnerability. The vulnerable function is not a specific PHP method but rather the rendering logic within the Blade template associated with the Filament\Forms\Components\RichEditor class.
Filament\Forms\Components\RichEditorpackages/forms/resources/views/components/rich-editor.blade.php
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| filament/forms | composer | >= 3.0.0, <= 3.3.52 | 3.3.53 |