What is the CVSS score of CVE-2026-42612?

CVE-2026-42612 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Grav CMS are affected by CVE-2026-42612?

Grav CMS versions prior to 2.0.0-beta.2 contain a stored cross-site scripting vulnerability that allows authenticated publishers to inject malicious JavaScript into content, which executes when…. A patch is available.

How to fix or mitigate CVE-2026-42612?

Within 24 hours: Audit Grav CMS deployment version and identify all active publisher-level user accounts. Within 7 days: Apply Grav 2.0.0-beta.2 or later (vendor-released patch confirmed in commit 5a12f9be8); verify patch installation and clear all cached content. Within 30 days: Conduct content audit for injected event handlers matching pattern <*on*= (unquoted attributes); review publisher account activity logs for suspicious edits; implement principle of least privilege to restrict publisher account creation.

Grav CMS CVE-2026-42612

HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-05-05 https://github.com/getgrav/grav

GHSA-9695-8fr9-hw5q

XSS PHP

8.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

May 05, 2026 - 21:48 vuln.today

Analysis Generated

May 05, 2026 - 21:48 vuln.today

DescriptionGitHub Advisory

Summary

A stored Cross-Site Scripting (XSS) vulnerability in getgrav/grav allows publisher-level accounts to execute arbitrary JavaScript. The issue arises from a blacklist bypass in the detectXss() function when handling unquoted HTML event attributes.

Details

The detectXss() function relies on a blacklist pattern to filter malicious attributes. The specific regex pattern used to match on* events is flawed:

php

'on_events' => '#(<[^>]+[a-z\x00-\x20\"\'\/])(on[a-z]+|xmlns)\s*=[\s|\'\"].*[\s|\'\"]>#iUu'

This pattern fails to properly identify on* event handlers that are constructed without quotation marks. This allows an attacker to completely bypass the filter. *Note: It is highly recommended to replace this blacklist approach with a robust, established HTML sanitization library.*

PoC

An attacker with publisher-level access can reproduce this by injecting the following payload into any vulnerable content field:

html

<img src=x onerror=eval(atob(/YWxlcnQoZG9jdW1lbnQuY29va2llKQ/.source))>

Execution Details: The onerror event is written without quotes to bypass the regex. Because unquoted attributes are restricted in their character usage (e.g., the = symbol cannot be used easily), the payload leverages atob() and regex .source to decode the base64 string YWxlcnQoZG9jdW1lbnQuY29va2llKQ (which translates to alert(document.cookie)). The atob() function conveniently auto-completes the necessary = padding for the base64 string.

Impact

Vulnerability Type: Stored Cross-Site Scripting (XSS)
Impacted Parties: Any user (including administrators) who views the compromised content published by the attacker.
Consequences: Attackers can execute malicious scripts in a victim's browser, leading to session hijacking (cookie theft), unauthorized actions.

---

Maintainer note - fix applied (2026-04-24)

Fixed in Grav core on the 2.0 branch: commit 5a12f9be8 - will ship in 2.0.0-beta.2.

What changed: the on_events regex in Security::detectXss() no longer requires quotes or whitespace around =. The previous form:

'on_events' => '#(<[^>]+[\s\x00-\x20\"\'\/])(on\s*[a-z]+|xmlns)\s*=[\s|\'\"].*[\s|\'\"]>#iUu'

required [\s|'"] immediately after the =, so <img src=x onerror=alert(1)> slid past. The new regex drops the value-matching tail entirely and just flags the presence of an on*= attribute anywhere inside a tag:

'on_events' => '#<[^>]*?[\s\x00-\x20\"\'\/](on\s*[a-z]+|xmlns)\s*=#iu'

Detecting the attribute name + = is enough for a tripwire - the trade-off is occasional false positives on legitimate attribute *values* containing on*= substrings, which the maintainer can hand-approve.

This same regex bypass was the detection-layer half of GHSA-c2q3-p4jr-c55f and GHSA-w8cg-7jcj-4vv2; the fix here knocks both down.

Files:

system/src/Grav/Common/Security.php.
tests/unit/Grav/Common/Security/DetectXssTest.php - 18 cases: unquoted PoCs, quoted-form regression, safe-content negatives.

AnalysisAI

Stored cross-site scripting in Grav CMS allows publisher-level authenticated users to execute arbitrary JavaScript in victim browsers by injecting unquoted HTML event handlers that bypass the detectXss() blacklist regex. The flawed pattern failed to detect on* event attributes without surrounding quotes, enabling payloads like <img src=x onerror=eval(...)> to persist in content fields and execute when administrators or other users view the compromised page. Vendor-released patch confirmed in commit 5a12f9be8 (Grav 2.0.0-beta.2), which tightens the on_events regex to flag unquoted attributes, adds dangerous XML namespace tags (svg, math) to the default blocklist, and hardens MediaObjectTrait::attribute() with strict identifier validation. Publicly available exploit code exists. EPSS and KEV data not provided; exploitation requires publisher-level account privileges.

Technical ContextAI

Grav is a flat-file PHP content management system. The vulnerability stems from CWE-79 (Improper Neutralization of Input During Web Page Generation) in the Security::detectXss() function, which uses a regex-based blacklist to sanitize user-submitted HTML. The original on_events pattern required whitespace or quotes immediately after the = sign in event attributes, allowing unquoted syntax like onerror=alert(1) to slip through. HTML5 permits unquoted attribute values containing alphanumerics and a limited set of punctuation, which attackers exploited by encoding payloads via atob() and regex .source to work around character restrictions. The affected package is pkg:composer/getgrav_grav prior to version 2.0.0-beta.2. The commit diff shows the fix also addresses related GitHub Security Advisories (GHSA-c2q3-p4jr-c55f, GHSA-w8cg-7jcj-4vv2) by expanding the dangerous tag list and gating attribute names in MediaObjectTrait to prevent Markdown-based injection vectors. Additionally, the patch hardens SVG dimension parsing against XXE attacks and Installer::unZip against Zip Slip path traversal, indicating a comprehensive security overhaul of the 2.0 branch.

RemediationAI

Upgrade to Grav 2.0.0-beta.2 or later, which includes the fix from commit 5a12f9be8314682c8713e569e330f11805d0a663 (https://github.com/getgrav/grav/commit/5a12f9be8314682c8713e569e330f11805d0a663). The patch replaces the vulnerable on_events regex in Security::detectXss() with a stricter pattern that detects on*= attributes regardless of quoting, expands the default xss_dangerous_tags list to include svg, math, option, and select, and hardens MediaObjectTrait::attribute() to reject event handlers and other dangerous attribute names. For production systems unable to deploy a beta release, apply the commit as a manual patch to system/src/Grav/Common/Security.php and system/config/security.yaml. Compensating controls: restrict publisher role assignment to fully trusted accounts only, enable Content Security Policy headers to mitigate XSS impact (set script-src 'self' and disable 'unsafe-inline'), audit existing content for unquoted event attributes using grep/regex search for patterns like onerror=, onload=, onclick= without surrounding quotes, and configure web application firewalls to block HTML event attributes in POST bodies. Note that CSP is defense-in-depth and may break legitimate inline scripts in Grav themes; test thoroughly. If downgrading to 1.x stable, verify whether the 1.x branch received a backport of this fix via the Grav release notes.