Filament has unvalidated ColorColumn and ColorEntry values that can be used for Cross-site Scripting

Vulnerability

A cross-site scripting (XSS) vulnerability exists in Filament versions v3.0.0 through v3.2.114. If a user-supplied value passed to a ColorColumn or ColorEntry (used in tables and infolists) is not a valid color and contains a specific set of characters, the value is rendered unsanitized. This occurs because the value is directly interpolated into the @style() Blade directive without escaping special characters [1][2].

Exploitation

The attack requires an attacker to be able to store a malicious value in the database that is later rendered by a ColorColumn or ColorEntry. For example, a value like blue;">alert('XSS')</script style=" would be inserted into the generated HTML as part of a style attribute. No authentication is mentioned in the advisory, but the attacker must have the ability to inject such values (e.g., via a form or data import). The exploit is stored XSS — the malicious code executes when a victim views the page with the color component [2].

Impact

An attacker who successfully exploits this vulnerability can execute arbitrary JavaScript in the context of a victim's session. This can lead to data theft, session hijacking, or other client-side attacks. The advisory confirms that the vulnerability affects both ColorColumn (reported by Mattis, @sv-LayZ) and ColorEntry [2].

Mitigation

The vulnerability is fixed in Filament v3.2.115. The fix uses Laravel's e() helper to escape special characters in the @style() directive for both components [1][4]. Users are strongly advised to upgrade. The project also published additional color validation documentation to encourage best practices [2].