Grav API Plugin <= 1.0.12 Vulnerable to Remote Code Execution
- Severity
- CRITICAL
- CVSS
- 9.8
- Affected component
- grav api plugin (npm)
- Patched version
- 1.0.13
The Grav API plugin versions before 1.0.13 contain a critical vulnerability that allows attackers with a scoped api.config.write key to execute arbitrary commands remotely. Users of affected versions should upgrade immediately.
What happened
The Grav API plugin, available on npm, has a critical vulnerability tracked as CVE-2026-72830. This vulnerability allows attackers with a scoped api.config.write key to inject arbitrary commands into scheduler.custom_jobs, leading to remote code execution. Versions before 1.0.13 are affected. The issue was first flagged on 2026-08-14 and confirmed shortly thereafter.
The vulnerability arises from a failure to enforce API key scope caps in ConfigController super-scope gates. This allows scoped keys to write scheduler configuration, enabling the injection of arbitrary commands that execute via Symfony Process.
What to do about it
- Upgrade to Grav API plugin version 1.0.13 or later to mitigate the risk of remote code execution.
- Review your API key scopes and ensure they are correctly configured to prevent unauthorized access.
- Monitor your systems for any unusual activity that may indicate an attempted exploit of this vulnerability.
- Consult the primary sources for the most up-to-date information and patches.
How 0Day would have caught this
grav api plugin is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
If you are using the Grav API plugin version before 1.0.13, you are affected by this vulnerability.
What should I do right now?
Upgrade to Grav API plugin version 1.0.13 or later to mitigate the risk of remote code execution.
Has this been exploited in the wild?
No, this vulnerability has not been reported as exploited in the wild.
Where can I find more information?
Consult the primary sources provided for the most up-to-date information and patches.