Koyokr

**Name of the Vulnerable Software and Affected Versions** Grav versions 1.5.2 through 2.0.12 **Description** A stored cross-site scripting issue exists in the `Security::detectXss()` function located in system/src/Grav/Common/Security.php. The event-handler scan uses a regular expression that fails to account for the `>` character when it appears inside a quoted attribute value. This discrepancy between the detector and the browser allows a page editor without `admin.super` privileges to save malicious content, such as `<img src=x title=">" onerror=alert(document.domain)>`. The payload is stored and subsequently executed in the site origin when viewed by any visitor, including unauthenticated users. **Recommendations** Update to version 2.0.13.

**Name of the Vulnerable Software and Affected Versions** DOMPurify versions prior to 3.4.13 **Description** An issue exists in the `IN PLACE` sanitization process where element-removal hooks do not properly neutralize detached subtrees. This allows attackers to provide HTML containing event handlers on descendant elements that execute after the sanitization process is finished, despite the returned root element appearing clean. This leads to cross-site scripting, a technique where malicious scripts are injected into trusted websites. **Recommendations** Update to version 3.4.13 or later.

**Name of the Vulnerable Software and Affected Versions** Jodit Editor versions prior to 4.12.28 **Description** The built-in clean-html sanitizer can be bypassed using a MathML/<style> carrier. This technique hides dangerous elements from the sanitizer's element walk, allowing no-interaction event handlers to persist in the editor value. This can lead to Mutation XSS (Cross-Site Scripting), where an attacker-influenced HTML input results in the execution of malicious handlers, such as `onload` or `onfocus` within an `<img>` tag, when the output is rendered via `element.innerHTML = editor.value` without requiring user interaction. **Recommendations** Update to version 4.12.28.