filament/infolists

[READ ONLY] Subtree split of the Filament Infolist Builder (see filamentphp/filament)

View on Packagist

View on Github

Activity

Latest release: 3h ago
Total releases: 325
Cadence: ~daily
Last 12 months: 84

Reach

Stars: 13

Details

License: MIT
First release: Jan 22, 2023

Releases

Version	Released
`v5.8.2` patch	Sep 15, 2026
`v4.13.2` patch	Sep 15, 2026
`v5.8.1` patch	Sep 07, 2026
`v5.8.0` minor	Sep 07, 2026
`v4.13.1` patch	Sep 07, 2026
`v4.13.0` minor	Sep 07, 2026
`v5.7.8` patch	Aug 31, 2026
`v5.7.7` patch	Aug 31, 2026
`v4.12.8` patch	Aug 31, 2026
`v4.12.7` patch	Aug 31, 2026
`v5.7.6` patch	Aug 05, 2026
`v4.12.6` patch	Aug 05, 2026
`v5.7.5` patch	Jul 29, 2026
`v4.12.5` patch	Jul 29, 2026
`v4.12.3` patch	Jul 22, 2026
`v5.7.3` patch	Jul 22, 2026
`v5.7.1` patch	Jul 17, 2026
`v4.12.1` patch	Jul 17, 2026
`v5.7.0` minor	Jul 17, 2026
`v4.12.0` minor	Jul 17, 2026
`v5.7.0-beta4` pre	Jul 14, 2026
`v4.12.0-beta4` pre	Jul 14, 2026
`v4.12.0-beta3` pre	Jul 10, 2026
`v5.7.0-beta3` pre	Jul 10, 2026
`v4.12.0-beta2` pre	Jul 02, 2026
`v5.7.0-beta2` pre	Jul 02, 2026
`v5.6.8` patch	Jul 02, 2026
`v4.11.8` patch	Jul 02, 2026
`v5.7.0-beta1` pre	Jun 25, 2026
`v4.12.0-beta1` pre	Jun 25, 2026
`v3.3.55` patch	Jun 12, 2026
`v3.3.54` patch	Jun 12, 2026
`v5.6.7` patch	Jun 08, 2026
`v4.11.7` patch	Jun 08, 2026
`v5.6.6` patch	May 22, 2026
`v4.11.6` patch	May 22, 2026
`v5.6.4` patch 1 CVE	May 20, 2026
`v4.11.4` patch 1 CVE	May 20, 2026
`v5.6.3` patch 1 CVE	May 11, 2026
`v4.11.3` patch 1 CVE	May 11, 2026
`v5.6.2` patch 1 CVE	May 02, 2026
`v4.11.2` patch 1 CVE	May 02, 2026
`v5.6.1` minor 1 CVE	Apr 21, 2026
`v4.11.1` minor 1 CVE	Apr 21, 2026
`v5.5.2` patch 1 CVE	Apr 14, 2026
`v4.10.2` patch 1 CVE	Apr 14, 2026
`v5.5.0` minor 1 CVE	Apr 07, 2026
`v4.10.0` minor 1 CVE	Apr 07, 2026
`v5.4.4` patch 1 CVE	Apr 03, 2026
`v4.9.4` patch 1 CVE	Apr 03, 2026

1–50 of 325

Repository

filamentphp/infolists

Forks: 3
Open issues: 0
Language: PHP

Dependencies (3)

Depends on

v5.8.2

Used by

Supply-chain exposure

42 tracked projects depend on this, <1% of every package we track.

A known CVE here directly exposes every one of them.

Known CVEs (2)

CVE-2026-48167 GHSA-3fc8-8hp6-6jr4 Jun 23, 2026

Filament: Unvalidated ImageColumn and ImageEntry values can be used for XSS

6.4 / 10
Medium
Network Low Low None Changed Low Low None

The ImageColumn and ImageEntry components render raw database values without escaping HTML. Where the data passed to these components isn't validated, an attacker could plant malicious HTML or JavaScript and achieve stored XSS that executes for users who view the table or schema.

Affected versions

v4.0.0v4.0.1v4.0.10v4.0.11v4.0.12v4.0.13v4.0.14v4.0.15v4.0.16v4.0.17v4.0.18v4.0.19

+ 91 more Show less

v4.0.2v4.0.20v4.0.3v4.0.4v4.0.5v4.0.6v4.0.7v4.0.8v4.0.9v4.1.0v4.1.1v4.1.10v4.1.2v4.1.3v4.1.4v4.1.5v4.1.6v4.1.7v4.1.8v4.1.9v4.10.0v4.10.1v4.10.2v4.11.0v4.11.1v4.11.2v4.11.3v4.11.4v4.2.0v4.2.1v4.2.2v4.2.3v4.2.4v4.3.0v4.3.1v4.4.0v4.5.0v4.5.1v4.5.2v4.5.3v4.6.0v4.6.1v4.6.2v4.6.3v4.7.0v4.7.1v4.7.2v4.7.3v4.7.4v4.8.0v4.8.1v4.8.2v4.8.3v4.8.4v4.8.5v4.9.0v4.9.1v4.9.2v4.9.3v4.9.4v4.9.5v5.0.0v5.1.0v5.1.1v5.1.2v5.1.3v5.2.0v5.2.1v5.2.2v5.2.3v5.2.4v5.3.0v5.3.1v5.3.2v5.3.3v5.3.4v5.3.5v5.4.0v5.4.1v5.4.2v5.4.3v5.4.4v5.4.5v5.5.0v5.5.1v5.5.2v5.6.0v5.6.1v5.6.2v5.6.3v5.6.4

Fixed in

4.11.55.6.5

References

https://github.com/filamentphp/filament/security/advisories/GHSA-3fc8-8hp6-6jr4
https://nvd.nist.gov/vuln/detail/CVE-2026-48167
https://github.com/filamentphp/filament

Updated Sep 10, 2026 · Source: OSV.dev
CVE-2024-47186 GHSA-9h9q-qhxg-89xr Sep 27, 2024

Filament has unvalidated ColorColumn and ColorEntry values that can be used for Cross-site Scripting

6.1 / 10
Medium
Network Low None Required Changed Low Low None

Summary

If values passed to a ColorColumn or ColumnEntry are not valid and contain a specific set of characters, applications are vulnerable to XSS attack against a user who opens a page on which a color column or entry is rendered.

Versions of Filament from v3.0.0 through v3.2.114 are affected.

Please upgrade to Filament v3.2.115.

PoC

For example, using a value such as:

blue;"><script>alert('There\'s a security problem here')</script style="

Would get passed into the @style() Blade directive from Laravel to render the correct background color, where $state contains the value:

<div @style([ "background-color: {$state}" => $state, ])></div>

Since Laravel does not escape special characters within the @style Blade directive, the effective output HTML would be:

<div style="background-color: blue;"><script>alert('There\'s a security problem here')</script style=""></div>

Creating the opportunity for arbitrary JS to run if it was stored in the database.

Response

This vulnerability (in ColorColumn only) was reported by @sv-LayZ, who reported the issue and patched the issue during the evening of 25/09/2024. Thank you Mattis.

The review process concluded on 27/09/2024, which revealed the issue was also present in ColorEntry. This was fixed the same day and Filament v3.2.115 followed to escape any special characters while outputting inline styles like this:

<div @style([ 'background-color: ' . e($state) => $state, ])></div>

Although these components are no longer vulnerable to this type of XSS attack, it is good practice to validate colors, and since many Filament users may be accepting color input using the ColorPicker form component, additional color validation documentation was published.

Affected versions

v3.0.0v3.0.1v3.0.10v3.0.100v3.0.101v3.0.102v3.0.103v3.0.11v3.0.12v3.0.13v3.0.14v3.0.15

+ 260 more Show less

v3.0.16v3.0.17v3.0.18v3.0.19v3.0.2v3.0.20v3.0.21v3.0.22v3.0.23v3.0.24v3.0.25v3.0.26v3.0.27v3.0.28v3.0.29v3.0.3v3.0.30v3.0.31v3.0.32v3.0.33v3.0.34v3.0.35v3.0.36v3.0.37v3.0.38v3.0.39v3.0.4v3.0.40v3.0.41v3.0.42v3.0.43v3.0.44v3.0.45v3.0.46v3.0.47v3.0.48v3.0.49v3.0.5v3.0.50v3.0.51v3.0.52v3.0.53v3.0.54v3.0.55v3.0.56v3.0.57v3.0.58v3.0.59v3.0.6v3.0.60v3.0.61v3.0.62v3.0.63v3.0.64v3.0.65v3.0.66v3.0.67v3.0.68v3.0.69v3.0.7v3.0.70v3.0.71v3.0.72v3.0.73v3.0.74v3.0.75v3.0.76v3.0.77v3.0.78v3.0.79v3.0.8v3.0.80v3.0.81v3.0.82v3.0.83v3.0.84v3.0.85v3.0.86v3.0.87v3.0.88v3.0.89v3.0.9v3.0.90v3.0.91v3.0.92v3.0.93v3.0.94v3.0.95v3.0.96v3.0.97v3.0.98v3.0.99v3.1.0v3.1.0-alpha1v3.1.0-alpha2v3.1.0-alpha3v3.1.0-alpha4v3.1.1v3.1.10v3.1.11v3.1.12v3.1.13v3.1.14v3.1.15v3.1.16v3.1.17v3.1.18v3.1.19v3.1.2v3.1.20v3.1.21v3.1.22v3.1.23v3.1.24v3.1.25v3.1.26v3.1.27v3.1.28v3.1.29v3.1.3v3.1.30v3.1.31v3.1.32v3.1.33v3.1.34v3.1.35v3.1.36v3.1.37v3.1.39v3.1.4v3.1.40v3.1.41v3.1.42v3.1.43v3.1.44v3.1.45v3.1.46v3.1.47v3.1.5v3.1.6v3.1.7v3.1.8v3.1.9v3.2.0v3.2.1v3.2.10v3.2.100v3.2.101v3.2.102v3.2.103v3.2.104v3.2.105v3.2.106v3.2.107v3.2.108v3.2.109v3.2.11v3.2.110v3.2.111v3.2.112v3.2.113v3.2.114v3.2.12v3.2.13v3.2.14v3.2.15v3.2.16v3.2.17v3.2.18v3.2.19v3.2.2v3.2.20v3.2.21v3.2.22v3.2.23v3.2.24v3.2.25v3.2.25-beta1v3.2.26v3.2.27v3.2.28v3.2.29v3.2.3v3.2.30v3.2.31v3.2.32v3.2.33v3.2.34v3.2.35v3.2.36v3.2.37v3.2.38v3.2.39v3.2.4v3.2.40v3.2.41v3.2.42v3.2.43v3.2.44v3.2.45v3.2.46v3.2.47v3.2.48v3.2.49v3.2.5v3.2.50v3.2.51v3.2.52v3.2.53v3.2.54v3.2.55v3.2.56v3.2.57v3.2.58v3.2.59v3.2.6v3.2.60v3.2.61v3.2.62v3.2.63v3.2.64v3.2.65v3.2.66v3.2.67v3.2.68v3.2.69v3.2.7v3.2.70v3.2.71v3.2.72v3.2.73v3.2.74v3.2.75v3.2.76v3.2.77v3.2.78v3.2.79v3.2.8v3.2.80v3.2.81v3.2.82v3.2.83v3.2.84v3.2.85v3.2.86v3.2.87v3.2.87-beta1v3.2.88v3.2.89v3.2.9v3.2.90v3.2.91v3.2.92v3.2.93v3.2.94v3.2.95v3.2.96v3.2.97v3.2.98v3.2.99

Fixed in

3.2.115

References

https://github.com/filamentphp/filament/security/advisories/GHSA-9h9q-qhxg-89xr
https://github.com/filamentphp/filament/commit/df7989352464d08eda5837ef50f9997fad902316
https://github.com/filamentphp/filament
https://github.com/filamentphp/filament/releases/tag/v3.2.115

Updated Feb 17, 2026 · Source: OSV.dev

Insights

Releases per month

last 12 months

Release mix

major 2
minor 24
patch 199
pre 99

325 releases

Dependencies over time

per release

Minimum runtime

over time

Release calendar

2026

Jan

Feb

Mar

Apr

May

Jun

Jul

Aug

Sep

Oct

Nov

Dec

Less More