https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 17:43:38 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-354932 EUVD-2026-354932 https://cve.radiocsirt.org/vuln/euvd-2026-354932 https://cve.radiocsirt.org/vuln/fkie_cve-2026-75828 <p>Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the detectXss() function where unpaired quotes in unquoted attribute values bypass event-handler detection. Authenticated editors can inject event handlers like onerror= that pass validation and execute in visitor browsers when page content is rendered.</p> <p>Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the detectXss() function where unpaired quotes in unquoted attribute values bypass event-handler detection. Authenticated editors can inject event handlers like onerror= that pass validation and execute in visitor browsers when page content is rendered.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-75828 https://cve.radiocsirt.org/vuln/ghsa-vfmf-q6x9-cw96 <p><strong>Affected:</strong> Packagist: getgrav/grav</p> <p>## Affected versions and vulnerable location</p> <p>- Confirmed on grav core at `78ebfc1` (tag 2.0.13). - Detector: `system/src/Grav/Common/Security.php:290`, the `on_events` regex, run via `patternMatches()` (`:315-330`). - The `on_events` pattern at HEAD: `#&lt;(?:&#34;[^&#34;]*&#34;|&#39;[^&#39;]*&#39;|[^&gt;&#34;&#39;])*?(?:[\s\x00-\x20&#34;&#39;/]|&#34;[^&#34;]*&#34;|&#39;[^&#39;]*&#39;)on\s*[a-z]+\s*=#iu` - Sole save-time guard for non-super content: `Validation::checkSafety()` (`system/src/Grav/Common/Data/Validation.php:160` scalars, `:165` arrays), invoked per field from `BlueprintSchema::validate` -&gt; `Validation::checkSafety` (`system/src/Grav/Common/Data/BlueprintSchema.php:248`). `security.xss_whitelist: [admin.super]` exempts only super-admins (`Validation.php:148`).</p> <p>## Root cause (distinct from GHSA-269c)</p> <p>GHSA-269c hardened the tag-body scan to be quote-aware so a `&gt;` inside a paired quoted attribute value is treated as data, not a tag close. That same quote-awareness opened a new gap: the regex treats ANY `&#34;` or `&#39;` as a string delimiter, but HTML only enters a quoted-value state when a quote appears immediately after `=`. A single unpaired quote sitting inside an unquoted attribute value is, to the browser, just a value character; to the regex it is an unterminated string that neither `[^&gt;&#34;&#39;]` nor `&#34;[^&#34;]*&#34;` can consume, so the lazy tag-body scan cannot advance past it to reach the following ` on...=` handler. No alignment matches and `detectXss()` returns null.</p> <p>## Proof (executed)</p> <p>The detector was replicated verbatim (the `on_e…</p> <p><strong>Affected:</strong> Packagist: getgrav/grav</p> <p>## Affected versions and vulnerable location</p> <p>- Confirmed on grav core at `78ebfc1` (tag 2.0.13). - Detector: `system/src/Grav/Common/Security.php:290`, the `on_events` regex, run via `patternMatches()` (`:315-330`). - The `on_events` pattern at HEAD: `#&lt;(?:&#34;[^&#34;]*&#34;|&#39;[^&#39;]*&#39;|[^&gt;&#34;&#39;])*?(?:[\s\x00-\x20&#34;&#39;/]|&#34;[^&#34;]*&#34;|&#39;[^&#39;]*&#39;)on\s*[a-z]+\s*=#iu` - Sole save-time guard for non-super content: `Validation::checkSafety()` (`system/src/Grav/Common/Data/Validation.php:160` scalars, `:165` arrays), invoked per field from `BlueprintSchema::validate` -&gt; `Validation::checkSafety` (`system/src/Grav/Common/Data/BlueprintSchema.php:248`). `security.xss_whitelist: [admin.super]` exempts only super-admins (`Validation.php:148`).</p> <p>## Root cause (distinct from GHSA-269c)</p> <p>GHSA-269c hardened the tag-body scan to be quote-aware so a `&gt;` inside a paired quoted attribute value is treated as data, not a tag close. That same quote-awareness opened a new gap: the regex treats ANY `&#34;` or `&#39;` as a string delimiter, but HTML only enters a quoted-value state when a quote appears immediately after `=`. A single unpaired quote sitting inside an unquoted attribute value is, to the browser, just a value character; to the regex it is an unterminated string that neither `[^&gt;&#34;&#39;]` nor `&#34;[^&#34;]*&#34;` can consume, so the lazy tag-body scan cannot advance past it to reach the following ` on...=` handler. No alignment matches and `detectXss()` returns null.</p> <p>## Proof (executed)</p> <p>The detector was replicated verbatim (the `on_e…</p> https://cve.radiocsirt.org/vuln/ghsa-vfmf-q6x9-cw96