Grav CMS Stored XSS Vulnerability: Early Warning and Mitigation
- Severity
- HIGH
- Affected component
- grav (packagist)
- Affected versions
- < 2.0.15
- Patched version
- 2.0.15
An early warning has been issued for a stored cross-site scripting vulnerability in Grav CMS versions before 2.0.15. Authenticated editors may be able to inject malicious scripts.
What happened
Grav CMS versions before 2.0.15 reportedly contain a stored cross-site scripting vulnerability in the detectXss() function. This vulnerability allows unpaired quotes in unquoted attribute values to bypass event-handler detection. Authenticated editors can inject event handlers like onerror= that pass validation and execute in visitor browsers when page content is rendered.
The vulnerability was first flagged on August 18, 2026. It is currently under investigation and has not been exploited in the wild. The issue arises from the detectXss() function missing an event-handler attribute after an unpaired quote in an unquoted attribute value.
What to do about it
- Upgrade to Grav CMS version 2.0.15 or later to mitigate the stored XSS vulnerability.
- Review your Grav CMS installation to ensure it is running a patched version.
- Monitor the primary sources for updates on the vulnerability and any additional mitigation steps.
How 0Day would have caught this
grav is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using Grav CMS version before 2.0.15.
What should I do right now?
Upgrade to Grav CMS version 2.0.15 or later immediately.
Has this been exploited in the wild?
No, this vulnerability has not been exploited in the wild as of the latest information.