GHSA-269c-h76q-8cxw

Source

https://github.com/advisories/GHSA-269c-h76q-8cxw

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-269c-h76q-8cxw/GHSA-269c-h76q-8cxw.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-269c-h76q-8cxw

Aliases

CVE-2026-72832

Published

2026-09-17T17:28:34Z

Modified

2026-09-17T17:45:04Z

Severity

5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

Grav: Stored XSS via quoted-attribute bypass in detectXss

Details

Summary

A page editor without admin.super can place an event handler after a > inside a quoted attribute. Grav accepts and stores the page, then executes the handler in the application origin when a visitor opens it.

Details

Security::detectXss() (system/src/Grav/Common/Security.php:253) anchors the on_events scan at < and uses [^>]*?, which cannot cross the first literal >. When that character is inside a quoted value, the browser keeps the tag open and parses the later onerror attribute, so the detector and browser disagree. AdminController::savePage() relies on this detector when saving content from page editors outside the admin.super whitelist.

PoC

I reproduced this with getgrav/grav 2.0.11 (ad9709f865b09b68798fb1ac375b484a8cc1d892), Admin 1.10.52, and Quark 2 1.1.4.

Sign in as a user with admin.login and admin.pages, but without admin.super.
Create or edit /xsstest and save this page body:

<img src=x title=">" onerror=alert(document.domain)>

Open /xsstest in a private browser window.

The save succeeds and the visitor sees an alert containing the site domain. With the body changed to <img src=x onerror=alert(1)>, the same endpoint rejects it with XSS issue detected and does not store it.

Impact

A page editor can execute JavaScript in the origin of every user who views the stored page, including unauthenticated visitors.

Anticipated objection and response

Although the detectXss() docblock describes it as a heuristic that cannot catch every XSS, this check is the storage-time boundary for page editors outside the default security.xss_whitelist of admin.super. The same endpoint rejects a plain handler but accepts this executable form, allowing a lower-trust editor to cross the boundary the check is intended to enforce.

Suggested fix

Prefer an HTML tokenizer or sanitizer that rejects event-handler attributes on parsed elements. If the existing tripwire remains, make its tag scan quote-aware instead of treating every > as a boundary. Add double-quoted and single-quoted regression cases plus the rejected plain-handler control.

Database specific

{
    "cwe_ids":  [
        "CWE-79"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-09-17T17:28:34Z",
    "nvd_published_at":  null,
    "severity":  "MODERATE"
}

References

Affected packages

Packagist / getgrav/grav

Package

Name: getgrav/grav
Purl: pkg:composer/getgrav/grav

Affected ranges

Type: ECOSYSTEM
Events: Introduced

1.5.2

Fixed

2.0.13

Affected versions

1.*

1.5.2

1.5.3

1.5.4

1.5.5

1.5.6

1.5.7

1.5.8

1.5.9

1.5.10

1.6.0-beta.1

1.6.0-beta.2

1.6.0-beta.3

1.6.0-beta.4

1.6.0-beta.5

1.6.0-beta.6

1.6.0-beta.7

1.6.0-beta.8

1.6.0-rc.1

1.6.0-rc.2

1.6.0-rc.3

1.6.0-rc.4

1.6.0

1.6.1

1.6.2

1.6.3

1.6.4

1.6.5

1.6.6

1.6.7

1.6.8

1.6.9

1.6.10

1.6.11

1.6.12

1.6.13

1.6.14

1.6.15

1.6.16

1.6.17

1.6.18

1.6.19

1.6.20

1.6.21

1.6.22

1.6.23

1.6.24

1.6.25

1.6.26

1.6.27

1.6.28

1.6.29

1.6.30

1.6.31

1.7.0-beta.1

1.7.0-beta.2

1.7.0-beta.3

1.7.0-beta.4

1.7.0-beta.5

1.7.0-beta.6

1.7.0-beta.7

1.7.0-beta.8

1.7.0-beta.9

1.7.0-beta.10

1.7.0-rc.1

1.7.0-rc.2

1.7.0-rc.3

1.7.0-rc.4

1.7.0-rc.5

1.7.0-rc.6

1.7.0-rc.7

1.7.0-rc.8

1.7.0-rc.9

1.7.0-rc.10

1.7.0-rc.11

1.7.0-rc.12

1.7.0-rc.13

1.7.0-rc.14

1.7.0-rc.15

1.7.0-rc.16

1.7.0-rc.17

1.7.0-rc.18

1.7.0-rc.19

1.7.0-rc.20

1.7.0

1.7.1

1.7.3

1.7.4

1.7.5

1.7.6

1.7.7

1.7.8

1.7.9

1.7.10

1.7.12

1.7.13

1.7.14

1.7.15

1.7.16

1.7.17

1.7.18

1.7.19

1.7.20

1.7.21

1.7.22

1.7.23

1.7.24

1.7.25

1.7.26

1.7.26.1

1.7.27

1.7.27.1

1.7.28

1.7.29

1.7.29.1

1.7.30

1.7.31

1.7.32

1.7.33

1.7.34

1.7.35

1.7.36

1.7.37

1.7.37.1

1.7.38

1.7.39

1.7.39.1

1.7.39.2

1.7.39.3

1.7.39.4

1.7.40

1.7.41

1.7.41.1

1.7.41.2

1.7.42

1.7.42.1

1.7.42.2

1.7.42.3

1.7.43

1.7.44

1.7.45

1.7.46

1.7.47

1.7.48

1.7.49

1.7.49.1

1.7.49.2

1.7.49.3

1.7.49.4

1.7.49.5

1.7.51

1.7.52

1.7.53

1.7.53.1

1.7.53.2

1.7.53.3

1.8.0-beta.1

1.8.0-beta.2

1.8.0-beta.3

1.8.0-beta.4

1.8.0-beta.5

1.8.0-beta.6

1.8.0-beta.7

1.8.0-beta.8

1.8.0-beta.9

1.8.0-beta.10

1.8.0-beta.11

1.8.0-beta.12

1.8.0-beta.13

1.8.0-beta.14

1.8.0-beta.15

1.8.0-beta.16

1.8.0-beta.17

1.8.0-beta.18

1.8.0-beta.19

1.8.0-beta.20

1.8.0-beta.21

1.8.0-beta.22

1.8.0-beta.23

1.8.0-beta.24

1.8.0-beta.25

1.8.0-beta.26

1.8.0-beta.27

1.8.0-beta.28

1.8.0-beta.29

2.*

2.0.0-beta.1

2.0.0-beta.2

2.0.0-beta.3

2.0.0-beta.4

2.0.0-rc.1

2.0.0-rc.2

2.0.0-rc.3

2.0.0-rc.4

2.0.0-rc.5

2.0.0-rc.6

2.0.0-rc.7

2.0.0-rc.8

2.0.0-rc.9

2.0.0-rc.10

2.0.0

2.0.1

2.0.2

2.0.3

2.0.4

2.0.5

2.0.6

2.0.7

2.0.8

2.0.9

2.0.10

2.0.11

2.0.12

Database specific

last_known_affected_version_range

"<= 2.0.12"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-269c-h76q-8cxw/GHSA-269c-h76q-8cxw.json"