Technical impact
The vulnerability resides in the detectXss() function of Grav prior to version 2.0.15, allowing a stored cross‑site scripting attack. Unpaired quotes in unquoted attribute values bypass the function’s event‑handler detection, enabling authenticated editors to inject attributes such as onerror=. When the content is later rendered for visitors, the injected scripts execute within their browsers. This can lead to session hijacking, credential theft, or malicious redirects, compromising the confidentiality and integrity of user data.
Affected Systems
The affected product is Grav, provided by getgrav. All releases before version 2.0.15 are vulnerable; upgrading to any 2.0.15 or later release removes the flaw.
Risk and Exploitability
With a CVSS score of 9.3, the vulnerability is high severity. The EPSS score is not available and the issue is not listed in the CISA KEV catalog, indicating no known widespread exploitation at the time of disclosure. Exploitation relies on having editorial access to inject content; an attacker with such privileges can embed malicious event handlers that will run in the browsers of site visitors. The risk is primarily client‑side, but the stored nature of the payload means it can affect all users who view the compromised content.
Github GHSA