Filament v3 contains a vulnerability in the disabled RichEditor field where its raw state is rendered without HTML sanitization. This allows an attacker to inject malicious HTML or JavaScript if the field's state data is not already sanitized, leading to cross-site scripting (XSS) attacks for users viewing the form. The issue is fixed in version 3.3.53, and does not affect Filament v4 or later.