https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T22:08:21.171594+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-85601 CVE-2026-85601 — Grav Admin before 2.0.20 Cross-Site Scripting via marked.js 2026-10-06T22:08:21.191017+00:00

Affected: getgrav grav

Grav Admin before 2.0.20 fails to sanitize output from marked.parse() before injecting it into the DOM via Svelte's {@html} directive in MarkdownEditor and MarkdownModal components. Attackers can inject javascript: URI schemes in plugin or theme changelogs to execute arbitrary code in authenticated admin sessions without requiring site access.