The vulnerability lies in Grav Admin’s handling of Markdown content. When a plugin or theme changelog contains a javascript URI, the system fails to escape the output before rendering it with Svelte’s {@html} directive, allowing an attacker to inject and execute arbitrary scripts within the admin interface. This flaw, identified as CWE‑79, lets an authenticated admin run malicious code that could steal credentials or modify site data.

Grav Admin installations of any version prior to 2.0.20 are affected. Administrators should verify the current version and apply any available updates to bring the system to 2.0.20 or later.

The CVSS score of 5.1 classifies the exploit as medium severity, the EPSS score is currently unavailable, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated admin session and a malicious plugin or theme providing a changelog entry with a javascript: URI. Once injected, code runs in the context of the admin, enabling credential theft, privilege escalation, or full site compromise.