CVE-2026-85601

MediumCVSS 5.4

Published: 04/09/2026(UTC)Updated: 10/09/2026(UTC)Translated: 04/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.17%

6th percentile - higher than 6% of all known CVEs

Summary

Grav Admin before version 2.0.20 fails to sanitize output from marked.parse() before injecting it into the DOM via Svelte's {@html} directive in MarkdownEditor and MarkdownModal components. Attackers can inject javascript: URI schemes in plugin or theme changelogs to execute arbitrary code in authenticated admin sessions without requiring site access.

Risk Assessment

Risk of arbitrary code execution in the context of an admin session, potentially leading to takeover of the admin panel and compromise of the entire Grav installation.

Recommendation

Update Grav Admin to version 2.0.20 or later and exercise caution when installing plugins and themes from untrusted sources.

Other vulnerabilities in Grav Admin

CVE-2026-85600Medium
Grav Admin (getgrav/grav-plugin-admin2) versions up to 2.0.19 contain a stored XSS vulnerability in the tHtml() function, which substitutes untrusted parameters such as usernames into translation templates before parsing the result as markdown. Server-side username validation does not block <, >, " or ', allowing an attacker to register a username with an HTML payload. When an administrator views a UI surface rendering the username through tHtml(), the payload executes in their session. Fixed in 2.0.21.

Original NVD description (English source)

Grav Admin before 2.0.20 fails to sanitize output from marked.parse() before injecting it into the DOM via Svelte's {@html} directive in MarkdownEditor and MarkdownModal components. Attackers can inject javascript: URI schemes in plugin or theme changelogs to execute arbitrary code in authenticated admin sessions without requiring site access.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS