fkie_cve-2026-42612

2026-09-30T23:23:05.671399+00:00

Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a stored Cross-Site Scripting (XSS) vulnerability in getgrav/grav allows publisher-level accounts to execute arbitrary JavaScript. The issue arises from a blacklist bypass in the detectXss() function when handling unquoted HTML event attributes. This vulnerability is fixed in 2.0.0-beta.2.

GHSA-9695-8fr9-hw5q — Grav Vulnerable to Publisher-Level Stored XSS via Unquoted Event Attributes

2026-09-30T23:23:05.671486+00:00

Affected: Packagist: getgrav/grav

### Summary A stored Cross-Site Scripting (XSS) vulnerability in `getgrav/grav` allows publisher-level accounts to execute arbitrary JavaScript. The issue arises from a blacklist bypass in the `detectXss()` function when handling unquoted HTML event attributes.

### Details The `detectXss()` function relies on a blacklist pattern to filter malicious attributes. The specific regex pattern used to match `on*` events is flawed: ```php 'on_events' => '#(<[^>]+[a-z\x00-\x20\"\'\/])(on[a-z]+|xmlns)\s*=[\s|\'\"].*[\s|\'\"]>#iUu' ``` This pattern fails to properly identify `on*` event handlers that are constructed without quotation marks. This allows an attacker to completely bypass the filter. *Note: It is highly recommended to replace this blacklist approach with a robust, established HTML sanitization library.*

### PoC An attacker with publisher-level access can reproduce this by injecting the following payload into any vulnerable content field: ```html ```

**Execution Details:** The `onerror` event is written wit…

Most recent entries from all

fkie_cve-2026-42612

GHSA-9695-8fr9-hw5q — Grav Vulnerable to Publisher-Level Stored XSS via Unquoted Event Attributes