CVE-2026-61453

Name of the Vulnerable Software and Affected Versions Grav version 2.0.0

Description An issue exists where the XSS blueprint validator Security::detectXss() processes raw page content before Twig processing occurs. If Twig content processing is enabled via twig content.process enabled: true, a user with page-write API permissions can bypass the validator using Twig's string concatenation operator (~) to dynamically create event handlers, dangerous tags, or protocols. Because the validator only sees the Twig expression and not the final rendered output, arbitrary JavaScript can be executed in the browsers of visitors when the content is rendered via {{ page.content|raw }}.

Recommendations Update Grav to version 2.0.1. Disable the twig content.process enabled setting to prevent Twig content processing.