CVE-2026-85601
Received Received - Intake

Grav Admin DOM XSS via MarkdownEditor MarkdownModal

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: VulnCheck

Description
Grav Admin before 2.0.20 fails to sanitize output from marked.parse() before injecting it into the DOM via Svelte's {@html} directive in MarkdownEditor and MarkdownModal components. Attackers can inject javascript: URI schemes in plugin or theme changelogs to execute arbitrary code in authenticated admin sessions without requiring site access.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-85601
EUVD
EUVD-2026-71024

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
grav admin to 2.0.20 (exc)
getgrav grav_admin to 2.0.20 (exc)
getgrav grav_admin to 2.0.19 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Grav Admin before version 2.0.20 has a Cross-Site Scripting (XSS) vulnerability where output from marked.parse() is not sanitized before being injected into the DOM via Svelte's {@html} directive in MarkdownEditor and MarkdownModal components. Attackers can inject javascript: URI schemes into plugin or theme changelogs to execute arbitrary code in authenticated admin sessions without needing site access.

Detection Guidance

Check Grav Admin version with: grep -r 'version' /path/to/grav/admin. If version is below 2.0.20, the system is vulnerable. Inspect MarkdownEditor.svelte and MarkdownModal.svelte for unsanitized marked.parse() output. Look for javascript: URI schemes in changelogs or user inputs.

Impact Analysis

This vulnerability allows attackers to execute arbitrary JavaScript code in the context of an authenticated admin session. This could lead to session or token theft, arbitrary actions performed as the admin, or full admin session takeover. Exploitation can occur through malicious changelog content in third-party plugins or themes, requiring no prior access to the Grav site.

Compliance Impact

This vulnerability primarily enables Cross-Site Scripting (XSS) attacks, which could lead to unauthorized data access or manipulation in admin sessions. For GDPR, this may violate Article 32 (security of processing) if personal data is exposed. HIPAA compliance could be impacted if protected health information is compromised through admin session takeover.

Mitigation Strategies

Upgrade Grav Admin to version 2.0.20 or later. Apply DOMPurify to sanitize marked.parse() output before DOM injection in MarkdownEditor.svelte and MarkdownModal.svelte. Review third-party plugin/theme changelogs for malicious javascript: URIs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85601. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart