CVE-2026-42612

Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a stored Cross-Site Scripting (XSS) vulnerability in getgrav/grav allows publisher-level accounts to execute arbitrary JavaScript. The issue arises from a blacklist bypass in the detectXss() function when handling unquoted HTML event attributes. This vulnerability is fixed in 2.0.0-beta.2.

CVSS v3 8.5 HIGH

8.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.1 / Impact : 4.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/getgrav/grav/commit/5a12f9be8314682c8713e569e330f11805d0a663	Patch
https://github.com/getgrav/grav/security/advisories/GHSA-9695-8fr9-hw5q	Exploit Patch Vendor Advisory
https://github.com/getgrav/grav/security/advisories/GHSA-9695-8fr9-hw5q	Exploit Patch Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:getgrav:grav::::::::
	cpe:2.3:a:getgrav:grav:2.0.0:beta1::::::

History

26 Oct 2026, 18:10

Type	Values Removed	Values Added
Summary		(es) Grav es una plataforma web basada en archivos. Antes de la versión 2.0.0-beta.2, una vulnerabilidad de cross-site scripting (XSS) almacenado en getgrav/grav permite a las cuentas con nivel de editor ejecutar JavaScript arbitrario. El problema surge de un bypass de lista negra en la función detectXss() al manejar atributos de evento HTML sin comillas. Esta vulnerabilidad está corregida en la versión 2.0.0-beta.2.

Information

Published : 2026-05-11 16:17

Updated : 2026-10-26 18:10

NVD link : CVE-2026-42612

Mitre link : CVE-2026-42612

CVE.ORG link : CVE-2026-42612

JSON object : View

Products Affected

getgrav

grav

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2026-42612", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42612", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-11T18:52:35.560213Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.7, "exploitabilityScore": 3.1}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "getgrav", "product": "grav", "versions": [{"status": "affected", "version": "< 2.0.0-beta.2"}]}]}], "published": "2026-05-11T16:17:34.350", "references": [{"url": "https://github.com/getgrav/grav/commit/5a12f9be8314682c8713e569e330f11805d0a663", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/getgrav/grav/security/advisories/GHSA-9695-8fr9-hw5q", "tags": ["Exploit", "Patch", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/getgrav/grav/security/advisories/GHSA-9695-8fr9-hw5q", "tags": ["Exploit", "Patch", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a stored Cross-Site Scripting (XSS) vulnerability in getgrav/grav allows publisher-level accounts to execute arbitrary JavaScript. The issue arises from a blacklist bypass in the detectXss() function when handling unquoted HTML event attributes. This vulnerability is fixed in 2.0.0-beta.2."}, {"lang": "es", "value": "Grav es una plataforma web basada en archivos. Antes de la versi\u00f3n 2.0.0-beta.2, una vulnerabilidad de cross-site scripting (XSS) almacenado en getgrav/grav permite a las cuentas con nivel de editor ejecutar JavaScript arbitrario. El problema surge de un bypass de lista negra en la funci\u00f3n detectXss() al manejar atributos de evento HTML sin comillas. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 2.0.0-beta.2."}], "lastModified": "2026-10-26T18:10:00.173", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:getgrav:grav:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9C284702-7909-4A5C-91FE-392FC5BA58C7", "versionEndIncluding": "1.8.0"}, {"criteria": "cpe:2.3:a:getgrav:grav:2.0.0:beta1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1ABB323F-20AF-40F3-BCD9-262644D242A1"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}