CVE-2026-86197

Name of the Vulnerable Software and Affected Versions Grav versions prior to 2.0.20

Description A cross-site scripting issue exists in the Twig sandbox policy. The policy allowlists the addJs() and addCss() methods on GravCommonAssets without implementing proper output escaping. This allows page editors to inject arbitrary scripts by registering malicious assets or injecting attributes, which are then rendered unescaped into the document head tags and executed for all visitors, including administrators.

Recommendations Update to version 2.0.20 or later.