CVE-2026-61453
published 2026-07-15CVE-2026-61453: Grav v2.0.0 contains a cross-site scripting vulnerability (fixed in 2.0.1). The XSS blueprint validator (Security::detectXss()) runs on raw page content before…
PriorityP427medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
0.20%
8.8th percentile
Grav v2.0.0 contains a cross-site scripting vulnerability (fixed in 2.0.1). The XSS blueprint validator (Security::detectXss()) runs on raw page content before Twig processing. When Twig content processing is enabled (twig_content.process_enabled: true), an attacker with page-write API permission can use Twig's string concatenation operator (~) to dynamically construct event handler names, dangerous tag names, or dangerous protocols at render time (e.g. {% set x = "on" ~ "error" %}). The validator sees only the harmless Twig expression and allows the content, but after Twig rendering the output (rendered via {{ page.content|raw }}) contains an active payload such as , executing arbitrary JavaScript in visitors' browsers.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| getgrav | grav | < 2.0.1 | 2.0.1 |
| getgrav | grav | >= 2.0.0 < 2.0.1 | 2.0.1 |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv4.05.1MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Grav: XSS Blueprint Validation Bypass via Twig String Concatenation
ghsa·2026-09-16
CVE-2026-61453 [MEDIUM] CWE-1336 Grav: XSS Blueprint Validation Bypass via Twig String Concatenation
Grav: XSS Blueprint Validation Bypass via Twig String Concatenation
## Summary
The XSS blueprint validator (`Security::detectXss()`) runs on the **raw page content before Twig processing**. An attacker can use Twig's string concatenation operator (`~`) to dynamically construct an event handler name at render time. The validator sees `{{ "on" ~ "error" }}` - a harmless Twig expression - and allows the content. After Twig processes the template, the output contains `` which is rendered via `{{ content|raw }}` and executes in the victim's browser.
---
## Details
**The two-stage attack** exploits the separation between validation and rendering:
**Stage 1 - what the XSS validator sees** (raw page content):
```twig
{% set x = "on" ~ "error" %}
```
The `detectXss()` function scans this s
GHSA
Grav v2.0.0 contains a cross-site scripting vulnerability (fixed in 2.0.1).
ghsa_unreviewed·2026-07-15
CVE-2026-61453 [MEDIUM] CWE-79 Grav v2.0.0 contains a cross-site scripting vulnerability (fixed in 2.0.1).
Grav v2.0.0 contains a cross-site scripting vulnerability (fixed in 2.0.1). The XSS blueprint validator (Security::detectXss()) runs on raw page content before Twig processing. When Twig content processing is enabled (twig_content.process_enabled: true), an attacker with page-write API permission can use Twig's string concatenation operator (~) to dynamically construct event handler names, dangerous tag names, or dangerous protocols at render time (e.g. {% set x = "on" ~ "error" %}). The validator sees only the harmless Twig expression and allows the content, but after Twig rendering the output (rendered via {{ page.content|raw }}) contains an active payload such as , executing arbitrary JavaScript in visitors' browsers.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-07-15
Published