CVE-2026-86197 in Grav
Summary
by MITRE • 09/05/2026
Grav before 2.0.20 contains a cross-site scripting vulnerability in the Twig sandbox policy that allowlists addJs and addCss methods on Grav\Common\Assets without proper output escaping. Page editors can inject arbitrary script by registering malicious assets or injecting attributes, which are rendered unescaped into document head tags and executed for all visitors including administrators.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/05/2026
The vulnerability identified in versions of the Grav content management system prior to 2.0.20 represents a significant cross-site scripting flaw rooted in the improper handling of asset registration within the Twig sandbox policy. Specifically, the addJs and addCss methods located in the Grav\Common\Assets class were found to allowlist certain inputs without enforcing adequate output escaping mechanisms. This architectural oversight creates a direct pathway for attackers to inject malicious client-side code into web pages that are subsequently rendered by user browsers. The core technical failure lies in the fact that while these methods permit the inclusion of external JavaScript and CSS resources, they fail to sanitize or encode special characters within the provided parameters before injecting them into the HTML document structure.
This deficiency allows authenticated page editors, who possess elevated privileges within the Grav platform, to exploit this behavior by registering malicious assets or injecting specially crafted attributes that are not properly escaped during rendering. When a visitor loads a compromised page, the unescaped script tags are executed immediately in the context of the victim's browser session. This execution occurs for all visitors accessing the affected pages, including high-privilege users such as system administrators. The impact is severe because it enables attackers to perform actions on behalf of authenticated users, steal sensitive cookies or session tokens, deface websites, or redirect users to phishing sites without their knowledge or consent.
From a classification perspective, this vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting (XSS). The attack vector leverages the trusted status of authenticated editors to bypass security controls that would otherwise prevent arbitrary script execution in untrusted contexts. In terms of tactical mapping within the MITRE ATT&CK framework for enterprise environments, this behavior corresponds to techniques involving Client-side Injection and potentially Credential Access if session hijacking is achieved through cookie theft. The vulnerability highlights a critical gap in input validation strategies where allowlisting specific methods does not equate to safe execution without rigorous output encoding at the point of rendering.
Mitigation efforts must prioritize upgrading the Grav installation to version 2.0.20 or later, as this release addresses the sanitization logic within the Twig sandbox policy and ensures that all dynamic content is properly escaped before being inserted into HTML documents. For organizations unable to upgrade immediately due to compatibility constraints, implementing a Web Application Firewall with robust XSS detection rules can provide an additional layer of defense by filtering out malicious payloads in HTTP requests targeting asset registration endpoints. Furthermore, developers should enforce strict output encoding practices for any data rendered within templates and review the Twig sandbox configuration to ensure that no methods are exposed without corresponding sanitization layers. Regular security audits focusing on input validation and output encoding across all user-facing components are essential to prevent similar vulnerabilities from being introduced in future updates or custom plugins.