CVE-2026-86197 json
Grav before 2.0.20 Cross-Site Scripting via Assets Sandbox
published 2026-08-21 2 mo ago modified 2026-10-08 31 d ago also GHSA-8hgv-xc77-jmcr , EUVD-2026-71999
- cvss
- 5.1
- version 4.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 35%
- public exploits
- 0
- none known
Summary
Grav before 2.0.20 contains a cross-site scripting vulnerability in the Twig sandbox policy that allowlists addJs and addCss methods on Grav\Common\Assets without proper output escaping. Page editors can inject arbitrary script by registering malicious assets or injecting attributes, which are rendered unescaped into document head tags and executed for all visitors including administrators.
Patch / fix
- packagist getgrav/grav 2.0.20
- getgrav grav 2.0.20
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 59 d ago
Exploit prediction
0.41% chance of exploitation in the next 30 days, higher than 35% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 5.1 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N |
| CNA | 4.0 | 5.1 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | getgrav/grav | <2.0.20 |
2.0.20 |
Affected products
- getgrav grav
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
github.com
/getgrav/grav/commit/a4e8c4b748eb338ee7ab1dd26e7620a93bade047
web
-
github.com
/getgrav/grav/security/advisories/GHSA-8hgv-xc77-jmcr
vendor-advisory, web
-
vulncheck.com
/advisories/grav-before-2.0.20-cross-site-scripting-via-assets-sandbox
third-party-advisory
-
github.com
/getgrav/grav
package
-
github.com
/getgrav/grav/releases/tag/2.0.20
web
Sources
- CVE List CVE-2026-86197
- GitHub Advisory GHSA-8hgv-xc77-jmcr
- NVD CVE-2026-86197
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.