PT-2026-37278 · Grav · Grav

Kc1Zs4 · Published 2026-05-05 · Updated 2026-05-27 · CVE-2026-42612

Positive Technologies (AI Summary)

CVSS v3.1

8.5

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Grav versions prior to 2.0.0-beta.2

Description A stored Cross-Site Scripting (XSS) issue allows publisher-level accounts to execute arbitrary JavaScript. The problem is caused by a blacklist bypass in the detectXss() function, which fails to properly identify HTML event attributes (such as on* events) when they are constructed without quotation marks. This allows an attacker to bypass the filter and execute malicious scripts in the browser of any user, including administrators, who views the compromised content, potentially leading to session hijacking or unauthorized actions.

Recommendations Update to version 2.0.0-beta.2. As a temporary workaround, restrict the permissions of publisher-level accounts to minimize the risk of malicious content injection.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-42612

GHSA-9695-8FR9-HW5Q

Affected Products

Grav

References · 8

• 🔥 https://github.com/getgrav/grav/security/advisories/GHSA-9695-8fr9-hw5q · Exploit
• https://github.com/getgrav/grav/commit/5a12f9be8314682c8713e569e330f11805d0a663 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-42612 · Security Note
• https://osv.dev/vulnerability/GHSA-9695-8fr9-hw5q · Vendor Advisory
• https://github.com/getgrav/grav · Note
• https://twitter.com/CVEnew/status/2053932465237168448 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2053925875607802133 · Twitter Post
• https://twitter.com/DFIR_Lab/status/2059440778619900271 · Twitter Post