CVE-2026-85601: Grav Admin before 2.0.20 Cross-Site Scripting via marked.js

Q: Which users are exposed to this issue?

Authenticated Grav Admin users are exposed when they view affected plugin or theme changelog content. Successful exploitation executes code in the authenticated administrator's session.

Q: What does an attacker need to exploit the vulnerability?

The attacker needs a way to place a javascript: URI in a plugin or theme changelog that is rendered by the affected Markdown editor or modal. The attacker does not need access to the site itself.

Q: Which releases should be remediated?

Grav Admin releases before 2.0.20 are affected. Update to version 2.0.20 or a later release.

Published Sep 4, 2026

Updated

Grav Admin before 2.0.20 fails to sanitize output from marked.parse() before injecting it into the DOM via Svelte's {@html} directive in MarkdownEditor and MarkdownModal components. Attackers can inject javascript: URI schemes in plugin or theme changelogs to execute arbitrary code in authenticated admin sessions without requiring site access.

Affected Software

1 affected component

Grav Admin<2.0.20

Event History

Sep 4, 2026

CVE Published

via MITRE·11:30 AM

Data Sourced

via MITRE·11:30 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which users are exposed to this issue?

Authenticated Grav Admin users are exposed when they view affected plugin or theme changelog content. Successful exploitation executes code in the authenticated administrator's session.

What does an attacker need to exploit the vulnerability?

The attacker needs a way to place a javascript: URI in a plugin or theme changelog that is rendered by the affected Markdown editor or modal. The attacker does not need access to the site itself.

Which releases should be remediated?