GHSA-vfmf-q6x9-cw96
Suggest an improvement- Source
- https://github.com/advisories/GHSA-vfmf-q6x9-cw96
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-vfmf-q6x9-cw96/GHSA-vfmf-q6x9-cw96.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-vfmf-q6x9-cw96
- Aliases
- Published
- 2026-09-17T20:43:43Z
- Modified
- 2026-09-17T21:00:04Z
- Severity
-
- 8.7 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N CVSS Calculator
- 9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N CVSS Calculator
- Summary
- Grav: detectXss() misses an event-handler attribute after an unpaired quote in an unquoted attribute value, giving stored XSS
- Details
-
Affected versions and vulnerable location
- Confirmed on grav core at
78ebfc1(tag 2.0.13). - Detector:
system/src/Grav/Common/Security.php:290, theon_eventsregex, run viapatternMatches()(:315-330). - The
on_eventspattern at HEAD:#<(?:"[^"]*"|'[^']*'|[^>"'])*?(?:[\s\x00-\x20"'/]|"[^"]*"|'[^']*')on\s*[a-z]+\s*=#iu - Sole save-time guard for non-super content:
Validation::checkSafety()(system/src/Grav/Common/Data/Validation.php:160scalars,:165arrays), invoked per field fromBlueprintSchema::validate->Validation::checkSafety(system/src/Grav/Common/Data/BlueprintSchema.php:248).security.xss_whitelist: [admin.super]exempts only super-admins (Validation.php:148).
Root cause (distinct from GHSA-269c)
GHSA-269c hardened the tag-body scan to be quote-aware so a
>inside a paired quoted attribute value is treated as data, not a tag close. That same quote-awareness opened a new gap: the regex treats ANY"or'as a string delimiter, but HTML only enters a quoted-value state when a quote appears immediately after=. A single unpaired quote sitting inside an unquoted attribute value is, to the browser, just a value character; to the regex it is an unterminated string that neither[^>"']nor"[^"]*"can consume, so the lazy tag-body scan cannot advance past it to reach the followingon...=handler. No alignment matches anddetectXss()returns null.Proof (executed)
The detector was replicated verbatim (the
on_eventsregex pluspatternMatches) with the shippedsystem/config/security.yamldefaults and run under PHP. Observed:baseline <img src=x onerror=alert(1)> => blocked (on_events) GHSA-269c <img src=x title=">" onerror=alert(1)> => blocked (on_events) # prior fix works BYPASS A <img src=x" onerror=alert(1)> => PASSES (no XSS detected) BYPASS B <img title=x" onerror=alert(1)> => PASSES (no XSS detected) BYPASS C <a href=x" onmouseover=alert(1)>x</a> => PASSES (no XSS detected) BYPASS D <img src=x' onerror=alert(1)> => PASSES (no XSS detected) BYPASS E <div id=x" onmouseover=alert(1)>hover</div> => PASSES (no XSS detected)Browser tokenization of
<img src=x" onerror=alert(1)>:srctakes the unquoted valuex"(space ends it),onerroris parsed as a separate live attribute,src404s andonerrorfires. None of the other rules cover it:img/a/divare not inxss_dangerous_tags, there is nojavascript:/data:scheme and nostyle/url/expression.Reachability
checkSafety()is the only save-time XSS screen for a non-super editor. The pages blueprint validatesheader.title(type: text) and pagecontent(markdown/textarea) withxss_checkon, so a bareonerror=is rejected but the payload above is stored verbatim. Page content is emitted through{{ page.content|raw }}and raw inline HTML passes Parsedown by default (markdown.escape_markup: false), so the handler runs for every visitor. The same detector core also backsSecurity::detectXssInEditorContent()(the GHSA-2c4f render-time-Twig save gate; callersPage.php:1359,Flex/Types/Pages/PageObject.php:194), thedetectXssFromPages()admin scanner (Admin.php:2096), and thexss()Twig function, so all of them report the payload clean.Auth required: an authenticated content editor with page/form edit rights but WITHOUT
admin.super.Suggested fix
Make the tag-body scan treat a quote as a delimiter only in the after-
=position, or normalize unquoted attribute values before the handler scan, so an unpaired quote inside an unquoted value cannot mask a followingon...=. A targeted addition: also flagon<name>=sequences that appear after a lone unbalanced quote within the same tag. BecausedetectXss()is a denylist, consider additionally encoding"/'in stored non-super content, or defaultingmarkdown.escape_markup: truefor non-super authors.Severity and CVSS reasoning
Suggested severity: High (matches GHSA-269c and the other stored-XSS advisories in this codebase).
Suggested CVSS:3.1 vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N(8.7).PR:L: a non-super editor account.UI:R: a visitor renders the page (foronerrorthe image simply loads/fails automatically).S:C/C:H/I:H: script in the site origin against every visitor, including admins viewing the content.
How I found it and a note on tooling
I read
detectXss()and reasoned about the difference between the HTML tokenizer's quoted-value state and the regex's string handling, then replicated the exacton_eventspattern andpatternMatches()with the shipped default config and ran the payloads to confirm the bypass and that the GHSA-269c payload is still blocked. I used AI assistance for the analysis and drafting and verified the detector behavior by execution. This is executed against a faithful replica of the detector with production config, not against a full running Grav site. - Confirmed on grav core at
- Database specific
{ "cwe_ids": [ "CWE-79" ], "github_reviewed": true, "github_reviewed_at": "2026-09-17T20:43:43Z", "nvd_published_at": null, "severity": "CRITICAL" }- References
Affected packages
Packagist / getgrav/grav
Package
- Name
- getgrav/grav
- Purl
- pkg:composer/getgrav/grav
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed2.0.15