CVE-2026-61453 Details
Description
Grav v2.0.0 contains a cross-site scripting vulnerability (fixed in 2.0.1). The XSS blueprint validator (Security::detectXss()) runs on raw page content before Twig processing. When Twig content processing is enabled (twig_content.process_enabled: true), an attacker with page-write API permission can use Twig's string concatenation operator (~) to dynamically construct event handler names, dangerous tag names, or dangerous protocols at render time (e.g. {% set x = "on" ~ "error" %}). The validator sees only the harmless Twig expression and allows the content, but after Twig rendering the output (rendered via {{ page.content|raw }}) contains an active payload such as <img src=1 onerror=alert(1)>, executing arbitrary JavaScript in visitors' browsers.
A cross-site scripting (XSS) vulnerability has been identified in Grav version 2.0.0, which has been fixed in version 2.0.1. The issue arises because the XSS blueprint validator processes raw page content before it is handled by Twig. When Twig processing is enabled, an attacker with permission to write pages can exploit this by using Twig's string concatenation operator to create event handler names, dangerous tag names, or harmful protocols that are executed at render time. The validator only detects the benign Twig expression, allowing the content to pass through. However, once the Twig content is rendered, it can include an active payload, such as an image tag with an onerror event that executes JavaScript in the browser of anyone visiting the page.
Users are advised to update Grav to version 2.0.1 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 15, 2026CISA-ADP
Assessed Jul 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/getgrav/grav/security/advisories/GHSA-2c4f-86xc-cr74 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/getgrav/grav/security/advisories/GHSA-2c4f-86xc-cr74 | [email protected] | AdvisoryExploitRemedyVendor |
| https://www.vulncheck.com/advisories/grav-before-xss-via-twig-string-concatenation | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Grav | >= 0, < 2.0.1 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 15, 2026 | CVE Modified | CISA-ADP |
| Jul 15, 2026 | New CVE Received | [email protected] |