CVE-2026-86197CWE-79cross-site-scripting

CVE-2026-86197

published September 5, 2026

CVSS
5.1
EPSS
0%
Percentile
34.4
In the wild
Unconfirmed
What it is

Grav before 2.0.20 contains a cross-site scripting vulnerability in the Twig sandbox policy that allowlists addJs and addCss methods on Grav\Common\Assets without proper output escaping. Page editors can inject arbitrary script by registering malicious assets or injecting attributes, which are rendered unescaped into document head tags and executed for all visitors including administrators.

The record
Technical detail
CVSS
5.1 · NONE
CVSS v4.0
5.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
EPSS
0.00412 · 34.4th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-09-05T17:18Z
References (2)
https://github.com/getgrav/grav/security/advisories/GHSA-8hgv-xc77-jmcr · [email protected]https://www.vulncheck.com/advisories/grav-before-2.0.20-cross-site-scripting-via-assets-sandbox · [email protected]
EPSS history
Timeline
  • 07 SEP 03:36Z
    EPSS moved — → 0%
    epss
  • 05 SEP 12:09Z
    Grav before 2.0.20 Cross-Site Scripting via Assets Sandbox
    cvelistv5