https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 21 Oct 2026 02:13:05 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-310037 EUVD-2026-310037 https://cve.radiocsirt.org/vuln/euvd-2026-310037 https://cve.radiocsirt.org/vuln/fkie_cve-2026-42842 <p>The form plugin for Grav adds the ability to create and use forms. Prior to 9.1.0, a Stored Cross-Site Scripting (XSS) vulnerability exists in the Grav CMS Form plugin&#39;s select field template. Taxonomy tag and category values are rendered with the Twig |raw filter in the admin panel, bypassing the global autoescape protection. An editor-level user can inject arbitrary JavaScript that executes in any administrator&#39;s browser session when they view or edit any page in the admin panel. This vulnerability is fixed in 9.1.0.</p> <p>The form plugin for Grav adds the ability to create and use forms. Prior to 9.1.0, a Stored Cross-Site Scripting (XSS) vulnerability exists in the Grav CMS Form plugin&#39;s select field template. Taxonomy tag and category values are rendered with the Twig |raw filter in the admin panel, bypassing the global autoescape protection. An editor-level user can inject arbitrary JavaScript that executes in any administrator&#39;s browser session when they view or edit any page in the admin panel. This vulnerability is fixed in 9.1.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-42842 https://cve.radiocsirt.org/vuln/ghsa-c2q3-p4jr-c55f <p><strong>Affected:</strong> Packagist: getgrav/grav</p> <p>### Summary</p> <p>A Stored Cross-Site Scripting (XSS) vulnerability exists in the Grav CMS Form plugin&#39;s select field template. Taxonomy tag and category values are rendered with the Twig `|raw` filter in the admin panel, bypassing the global autoescape protection. An editor-level user can inject arbitrary JavaScript that executes in any administrator&#39;s browser session when they view or edit any page in the admin panel.</p> <p>Additionally, Grav&#39;s built-in XSS detection (`Security::detectXss()`) can be bypassed by using payloads that close the `&lt;option&gt;/&lt;select&gt;` context and use unquoted event handlers - the `on_events` regex fails to match event handlers without quotes or trailing spaces before `&gt;`.</p> <p>### Important</p> <p>- The vulnerability is in the Form plugin (`select.html.twig`), which is installed by default with Grav - The XSS is cross-page: a malicious taxonomy value on one page executes when an admin edits any page, because taxonomy options are rendered from a shared global pool - An editor can exploit this without any other vulnerability - taxonomy fields are not in the server-side restricted fields list - The `HttpOnly` flag on session cookies prevents direct session theft, but the XSS can steal the admin nonce and perform privileged actions via JavaScript</p> <p>### Permissions Needed</p> <p>- Editor: can create or edit pages and set taxonomy tag/category values</p> <p>### Details</p> <p>The Form plugin&#39;s select field template renders option values using the `|raw` Twig filter, which outputs content wit…</p> <p><strong>Affected:</strong> Packagist: getgrav/grav</p> <p>### Summary</p> <p>A Stored Cross-Site Scripting (XSS) vulnerability exists in the Grav CMS Form plugin&#39;s select field template. Taxonomy tag and category values are rendered with the Twig `|raw` filter in the admin panel, bypassing the global autoescape protection. An editor-level user can inject arbitrary JavaScript that executes in any administrator&#39;s browser session when they view or edit any page in the admin panel.</p> <p>Additionally, Grav&#39;s built-in XSS detection (`Security::detectXss()`) can be bypassed by using payloads that close the `&lt;option&gt;/&lt;select&gt;` context and use unquoted event handlers - the `on_events` regex fails to match event handlers without quotes or trailing spaces before `&gt;`.</p> <p>### Important</p> <p>- The vulnerability is in the Form plugin (`select.html.twig`), which is installed by default with Grav - The XSS is cross-page: a malicious taxonomy value on one page executes when an admin edits any page, because taxonomy options are rendered from a shared global pool - An editor can exploit this without any other vulnerability - taxonomy fields are not in the server-side restricted fields list - The `HttpOnly` flag on session cookies prevents direct session theft, but the XSS can steal the admin nonce and perform privileged actions via JavaScript</p> <p>### Permissions Needed</p> <p>- Editor: can create or edit pages and set taxonomy tag/category values</p> <p>### Details</p> <p>The Form plugin&#39;s select field template renders option values using the `|raw` Twig filter, which outputs content wit…</p> https://cve.radiocsirt.org/vuln/ghsa-c2q3-p4jr-c55f