CVE-2026-85599 Overview
CVE-2026-85599 is a stored cross-site scripting (XSS) vulnerability in Grav Shortcode Core versions prior to 6.2.5. The flaw exists in the [lorem] tag parameter and [details] summary parameter, which are written to rendered pages without proper output escaping. Authenticated users with page-edit access can inject arbitrary HTML and JavaScript payloads. The injected script executes in the browser of any visitor who loads the affected page, including administrators. This creates an escalation path from limited editor privileges to full administrative control of the Grav content management system (CMS).
Critical Impact
Attackers with page-edit privileges can persist JavaScript that hijacks administrator sessions and takes over the Grav CMS.
Affected Products
- Grav Shortcode Core plugin versions before 6.2.5
- Grav CMS instances using the Shortcode Core plugin
- Any Grav site that renders [lorem] or [details] shortcodes in user-editable content
Discovery Timeline
- 2026-09-04 - CVE-2026-85599 published to NVD
- 2026-09-08 - Last updated in NVD database
Technical Details for CVE-2026-85599
Vulnerability Analysis
The vulnerability is classified as stored cross-site scripting under [CWE-79]. Grav Shortcode Core parses two shortcodes, [lorem] and [details], that accept user-controlled parameters. The plugin inserts the tag parameter of [lorem] and the summary parameter of [details] directly into the rendered HTML output. Neither parameter is HTML-escaped or sanitized before rendering.
Exploitation requires an authenticated account with page-edit permissions. Once a malicious shortcode is saved, the payload persists in the page content and executes for every subsequent visitor. Because Grav administrators routinely preview and review pages, an attacker can reliably hijack privileged sessions, exfiltrate authentication cookies, or issue authenticated actions on the victim's behalf.
Root Cause
The root cause is missing output encoding in the shortcode rendering pipeline. Parameter values supplied by editors are concatenated into HTML markup rather than passed through Grav's Twig auto-escaping or an explicit HTML escape routine. This violates the standard practice of treating all user-supplied content as untrusted at the rendering boundary.
Attack Vector
Exploitation is remote and requires low privileges (PR:L) plus user interaction (UI:P) — a victim must load the poisoned page. An attacker with editor access crafts a page containing a [lorem] shortcode whose tag attribute contains an HTML element with an inline JavaScript handler, or a [details] shortcode whose summary attribute contains script markup. When the page is rendered, the browser parses the injected markup and executes the attacker-controlled script in the origin of the Grav site. See the GitHub Security Advisory GHSA-hvm8-wx3f-j774 and the VulnCheck advisory for technical details.
Detection Methods for CVE-2026-85599
Indicators of Compromise
- Page markdown or database content containing [lorem] shortcodes with tag values that include <, >, on*= attributes, or javascript: URIs
- [details] shortcodes whose summary parameter contains HTML tags, script elements, or event handlers
- Unexpected outbound requests from administrator browsers to attacker-controlled domains after visiting edited pages
- New or modified administrator accounts created shortly after a low-privilege editor accessed the CMS
Detection Strategies
- Scan Grav user/pages/ directories for shortcode parameters containing HTML metacharacters or scripting keywords
- Review web server access logs for POST requests to Grav admin endpoints followed by anomalous session activity
- Inspect rendered HTML for [lorem] or [details] output containing unescaped tags such as <script>, <img onerror=, or <svg onload=
- Correlate editor account activity with subsequent administrator session anomalies in identity logs
Monitoring Recommendations
- Enable Content Security Policy (CSP) reporting to capture blocked inline script executions on Grav pages
- Monitor for privilege changes and configuration edits following any page save by non-administrator accounts
- Alert on any shortcode edit performed by accounts that do not routinely author content
How to Mitigate CVE-2026-85599
Immediate Actions Required
- Upgrade Grav Shortcode Core to version 6.2.5 or later on all Grav installations
- Audit existing page content for malicious [lorem] and [details] shortcode parameters and remove any injected payloads
- Review the editor account roster and revoke page-edit permissions from accounts that do not require them
- Rotate administrator session tokens and credentials after remediation
Patch Information
The maintainers fixed the issue in Grav Shortcode Core 6.2.5 by escaping the tag and summary parameters before rendering. Administrators should update through the Grav Package Manager (bin/gpm update shortcode-core) or via the admin plugin interface. Refer to the GitHub Security Advisory GHSA-hvm8-wx3f-j774 for the authoritative patch reference.
Workarounds
- Restrict page-edit permissions to trusted users until the plugin is upgraded
- Deploy a strict Content Security Policy that blocks inline scripts and disallows untrusted script sources
- Temporarily disable the Shortcode Core plugin if it is not required for site functionality
- Place a web application firewall (WAF) rule in front of the admin endpoint to block shortcode parameters containing HTML tags or event handler attributes
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
