CVE-2026-86197
1 advisory.
Packagist/getgrav/grav CVE-2026-86197: medium, EPSS 0.41%
Grav: Page editors can inject arbitrary script into rendered pages via the Twig sandbox's assets.addJs/addCss allowlist, escalating to super-admin
Action: Upgrade getgrav/grav to 2.0.20 or later.
composer require getgrav/grav:2.0.20Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.0.20 | - |
Fixed versions
| 2.0.20 |
Sources
- osv: GHSA-8hgv-xc77-jmcr
- https://github.com/getgrav/grav/security/advisories/GHSA-8hgv-xc77-jmcr
- https://github.com/getgrav/grav/commit/a4e8c4b748eb338ee7ab1dd26e7620a93bade047
- https://github.com/getgrav/grav
- https://github.com/getgrav/grav/releases/tag/2.0.20
CVE-2026-86197 · published · modified · JSON