CVE-2026-85601

Name of the Vulnerable Software and Affected Versions Grav Admin versions prior to 2.0.20

Description Insufficient sanitization of output from the marked.parse() function before it is injected into the Document Object Model (DOM) via Svelte's {@html} directive within the MarkdownEditor and MarkdownModal components. This allows attackers to inject javascript: URI schemes into plugin or theme changelogs, leading to arbitrary code execution in authenticated administrator sessions.

Recommendations Update Grav Admin to version 2.0.20 or later.