CVE-2026-42612 PUBLISHED

Grav: Publisher-Level Stored XSS via Unquoted Event Attributes

Assigner: GitHub_M
Reserved: 29.04.2026 Published: 11.05.2026 Updated: 11.05.2026

Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a stored Cross-Site Scripting (XSS) vulnerability in getgrav/grav allows publisher-level accounts to execute arbitrary JavaScript. The issue arises from a blacklist bypass in the detectXss() function when handling unquoted HTML event attributes. This vulnerability is fixed in 2.0.0-beta.2.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
CVSS Score: 8.5

Attack Vector	Network	Scope	Changed
Attack Complexity	Low	Confidentiality Impact	High
Privileges Required	Low	Integrity Impact	Low
User Interaction	None	Availability Impact	None

CVSS 3.1

Product Status

Vendor	getgrav
Product	grav
Versions	Version < 2.0.0-beta.2 is affected

References

https://github.com/getgrav/grav/security/advisories/GHSA-9695-8fr9-hw5q
https://github.com/getgrav/grav/commit/5a12f9be8314682c8713e569e330f11805d0a663

Problem Types

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE