Grav Admin CVE-2026-85601

Admin must open the changelog viewer (MarkdownEditor or MarkdownModal component) for a plugin or theme whose changelog has been crafted by the attacker to contain a javascript: URI scheme embedded in Markdown link syntax. The attacker does not need credentials on the victim Grav site, but the malicious package must be present in the admin panel's package listing - either installed, queued for install, or browsed from a repository the site owner has configured. Exploitation is therefore limited to scenarios where an admin actively views a changelog for attacker-controlled content. Sites that only install packages from trusted, reviewed sources, or that have disabled the Admin plugin's package management features, are not practically reachable via this vector.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N, score 5.1) accurately captures the attack profile: no privileges are needed on the victim site because the attack is delivered via a third-party package's changelog metadata, but active user interaction (admin viewing the changelog) is required, and direct impact on the vulnerable system itself is nil - all impact falls on the subsequent system (the admin browser session: SC:L, SI:L). There is no CISA KEV listing and no public proof-of-concept identified, and EPSS data is not provided. Real-world exploitation requires an admin to install or preview a package controlled by the attacker, which limits opportunistic mass exploitation compared to a fully pre-auth network-accessible attack. The 'RCE' tag in the input metadata is mislabeled - this is client-side JavaScript execution (XSS) in the admin's browser, not server-side remote code execution. Depending on the admin session's capabilities, the practical consequence could include credential theft, CSRF-like admin actions, or plugin manipulation, but these are secondary effects of the XSS, not direct RCE.

An attacker publishes a malicious Grav plugin or theme to a public registry (or distributes it directly) with a changelog entry containing a javascript: URI link rendered as Markdown. When a Grav site administrator browses to the plugin/theme listing or opens the MarkdownModal to inspect the package, the unsanitized marked.parse() output is injected via {@html}, causing the attacker's script to execute in the admin's authenticated browser session and potentially exfiltrating session cookies or issuing admin API calls. No public proof-of-concept code has been identified at time of analysis.