Skip to content
CVE PROGRAM SOURCE RECORD5.1 Medium

CVE-2026-85601

Grav Admin before 2.0.20 Cross-Site Scripting via marked.js

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

Grav Admin before 2.0.20 fails to sanitize output from marked.parse() before injecting it into the DOM via Svelte's {@html} directive in MarkdownEditor and MarkdownModal components. Attackers can inject javascript: URI schemes in plugin or theme changelogs to execute arbitrary code in authenticated admin sessions without requiring site access.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

getgrav grav

Default version status: unaffected

  • 0 to < 2.0.20affected
  • 2.0.20unaffected

References