CVE-2026-86197: Grav before 2.0.20 Cross-Site Scripting via Assets Sandbox
Grav before 2.0.20 contains a cross-site scripting vulnerability in the Twig sandbox policy that allowlists addJs and addCss methods on Grav\Common\Assets without proper output escaping. Page editors can inject arbitrary script by registering malicious assets or injecting attributes, which are rendered unescaped into document head tags and executed for all visitors including administrators.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A page editor who can supply Twig content that uses the sandboxed asset methods can exploit it. The injected script executes in the browsers of visitors to the affected page, including administrators.
What versions are affected?
Grav versions before 2.0.20 are affected. The provided information does not identify any other affected products or configurations.
What does an attacker need to do to trigger the XSS?
The attacker needs page-editor access and the ability to register malicious JavaScript or CSS assets, or inject attributes through the allowlisted addJs or addCss methods. Those values are rendered without proper escaping in document head tags.