What’s Vulnerable › Vulnerabilities

CVE-2026-86197: Grav before 2.0.20 Cross-Site Scripting via Assets Sandbox

• Severity: medium (CVSS 5.1 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-05 · updated 2026-10-08
• Weakness: CWE-79

Description

Grav before 2.0.20 contains a cross-site scripting vulnerability in the Twig sandbox policy that allowlists addJs and addCss methods on Grav\Common\Assets without proper output escaping. Page editors can inject arbitrary script by registering malicious assets or injecting attributes, which are rendered unescaped into document head tags and executed for all visitors including administrators.

Affected products

• getgrav grav: before 2.0.20 — fixed in 2.0.20

How to fix

Upgrade to a fixed version: getgrav grav 2.0.20. Check the vendor advisory for mitigations.

References

• https://github.com/getgrav/grav/security/advisories/GHSA-8hgv-xc77-jmcr
• https://www.vulncheck.com/advisories/grav-before-2.0.20-cross-site-scripting-via-assets-sandbox

Get alerted when CVE-2026-86197 or the next vulnerability affects your stack