Grav before 2.0.20 Cross-Site Scripting via Assets Sandbox
Grav before 2.0.20 contains a cross-site scripting vulnerability in the Twig sandbox policy that allowlists addJs and addCss methods on Grav\Common\Assets without proper output escaping. Page editors can inject arbitrary script by registering malicious assets or injecting attributes, which are rendered unescaped into document head tags and executed for all visitors including administrators.
CVE-2026-86197
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-86197
grav
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "getgrav",
"product": "grav",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "2.0.20",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.0.20",
"versionType": "semver"
}
],
"packageURL": "pkg:composer/getgrav/grav",
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-86197
Source reference:
/cveMetadata/cveId
Publisher severity
medium
Source reference: /containers/cna/metrics
- Event
- #12937 · Revision 1
- Added to Heist Feed
- Publisher date