https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 23:23:06 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-42612 <p>Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a stored Cross-Site Scripting (XSS) vulnerability in getgrav/grav allows publisher-level accounts to execute arbitrary JavaScript. The issue arises from a blacklist bypass in the detectXss() function when handling unquoted HTML event attributes. This vulnerability is fixed in 2.0.0-beta.2.</p> <p>Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a stored Cross-Site Scripting (XSS) vulnerability in getgrav/grav allows publisher-level accounts to execute arbitrary JavaScript. The issue arises from a blacklist bypass in the detectXss() function when handling unquoted HTML event attributes. This vulnerability is fixed in 2.0.0-beta.2.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-42612 https://vulnerability.circl.lu/vuln/ghsa-9695-8fr9-hw5q <p><strong>Affected:</strong> Packagist: getgrav/grav</p> <p>### Summary A stored Cross-Site Scripting (XSS) vulnerability in `getgrav/grav` allows publisher-level accounts to execute arbitrary JavaScript. The issue arises from a blacklist bypass in the `detectXss()` function when handling unquoted HTML event attributes.</p> <p>### Details The `detectXss()` function relies on a blacklist pattern to filter malicious attributes. The specific regex pattern used to match `on*` events is flawed: ```php &#39;on_events&#39; =&gt; &#39;#(&lt;[^&gt;]+[a-z\x00-\x20\&#34;\&#39;\/])(on[a-z]+|xmlns)\s*=[\s|\&#39;\&#34;].*[\s|\&#39;\&#34;]&gt;#iUu&#39; ``` This pattern fails to properly identify `on*` event handlers that are constructed without quotation marks. This allows an attacker to completely bypass the filter. *Note: It is highly recommended to replace this blacklist approach with a robust, established HTML sanitization library.*</p> <p>### PoC An attacker with publisher-level access can reproduce this by injecting the following payload into any vulnerable content field: ```html &lt;img src=x onerror=eval(atob(/YWxlcnQoZG9jdW1lbnQuY29va2llKQ/.source))&gt; ``` &lt;img width=&#34;1889&#34; height=&#34;482&#34; alt=&#34;image1&#34; src=&#34;https://github.com/user-attachments/assets/0f1a339b-25a8-4b6e-91af-8c59e6a39297&#34; /&gt; &lt;img width=&#34;3055&#34; height=&#34;920&#34; alt=&#34;image2&#34; src=&#34;https://github.com/user-attachments/assets/12680058-bbb3-4446-b58e-515533bb4e90&#34; /&gt; &lt;img width=&#34;2909&#34; height=&#34;1339&#34; alt=&#34;image3&#34; src=&#34;https://github.com/user-attachments/assets/c7ed7e61-8dcf-402d-8589-98d18978c71a&#34; /&gt;</p> <p>**Execution Details:** The `onerror` event is written wit…</p> <p><strong>Affected:</strong> Packagist: getgrav/grav</p> <p>### Summary A stored Cross-Site Scripting (XSS) vulnerability in `getgrav/grav` allows publisher-level accounts to execute arbitrary JavaScript. The issue arises from a blacklist bypass in the `detectXss()` function when handling unquoted HTML event attributes.</p> <p>### Details The `detectXss()` function relies on a blacklist pattern to filter malicious attributes. The specific regex pattern used to match `on*` events is flawed: ```php &#39;on_events&#39; =&gt; &#39;#(&lt;[^&gt;]+[a-z\x00-\x20\&#34;\&#39;\/])(on[a-z]+|xmlns)\s*=[\s|\&#39;\&#34;].*[\s|\&#39;\&#34;]&gt;#iUu&#39; ``` This pattern fails to properly identify `on*` event handlers that are constructed without quotation marks. This allows an attacker to completely bypass the filter. *Note: It is highly recommended to replace this blacklist approach with a robust, established HTML sanitization library.*</p> <p>### PoC An attacker with publisher-level access can reproduce this by injecting the following payload into any vulnerable content field: ```html &lt;img src=x onerror=eval(atob(/YWxlcnQoZG9jdW1lbnQuY29va2llKQ/.source))&gt; ``` &lt;img width=&#34;1889&#34; height=&#34;482&#34; alt=&#34;image1&#34; src=&#34;https://github.com/user-attachments/assets/0f1a339b-25a8-4b6e-91af-8c59e6a39297&#34; /&gt; &lt;img width=&#34;3055&#34; height=&#34;920&#34; alt=&#34;image2&#34; src=&#34;https://github.com/user-attachments/assets/12680058-bbb3-4446-b58e-515533bb4e90&#34; /&gt; &lt;img width=&#34;2909&#34; height=&#34;1339&#34; alt=&#34;image3&#34; src=&#34;https://github.com/user-attachments/assets/c7ed7e61-8dcf-402d-8589-98d18978c71a&#34; /&gt;</p> <p>**Execution Details:** The `onerror` event is written wit…</p> https://vulnerability.circl.lu/vuln/ghsa-9695-8fr9-hw5q