CVE-2026-75828

Name of the Vulnerable Software and Affected Versions Grav versions prior to 2.0.15

Description A stored cross-site scripting issue exists in the detectXss() function. Authenticated editors can bypass event-handler detection by using unpaired quotes in unquoted attribute values. This allows the injection of event handlers, such as onerror=, which pass validation and execute within the browsers of visitors when page content is rendered.

Recommendations Update to version 2.0.15 or later. As a temporary workaround, restrict the permissions of authenticated editors to prevent them from modifying page content until the update is applied.