CVE-2026-85601 Details
Description
Grav Admin before 2.0.20 fails to sanitize output from marked.parse() before injecting it into the DOM via Svelte's {@html} directive in MarkdownEditor and MarkdownModal components. Attackers can inject javascript: URI schemes in plugin or theme changelogs to execute arbitrary code in authenticated admin sessions without requiring site access.
A cross-site scripting vulnerability has been identified in Grav Admin versions prior to 2.0.20. The issue arises in the MarkdownEditor and MarkdownModal components, where output from marked.parse() is injected into the DOM using Svelte's {@html} directive without proper sanitization. This flaw allows attackers to inject javascript: URI schemes into plugin or theme changelogs, executing arbitrary code in the context of authenticated admin sessions, without needing access to the site.
Users can update to Grav Admin version 2.0.20 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 4, 2026CISA-ADP
Assessed Sep 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/getgrav/grav/security/advisories/GHSA-752r-88j4-vxm3 | [email protected] | AdvisoryExploitRemedyTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/grav-admin-before-2.0.20-cross-site-scripting-via-marked-js | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Grav Admin2 | <= 2.0.19 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 10, 2026 | CVE Modified | CISA-ADP |
| Sep 4, 2026 | New CVE Received | [email protected] |