CVE-2026-85601 Overview
CVE-2026-85601 is a Cross-Site Scripting (XSS) vulnerability in Grav Admin versions before 2.0.20. The flaw exists because output from marked.parse() is injected into the DOM through Svelte's {@html} directive in the MarkdownEditor and MarkdownModal components without sanitization. Attackers can embed javascript: URI schemes inside plugin or theme changelogs. When an authenticated administrator views the malicious changelog, the payload executes in the admin session. Exploitation does not require prior access to the target Grav site, only that an administrator interacts with attacker-controlled markdown content [CWE-79].
Critical Impact
Arbitrary JavaScript executes in authenticated Grav administrator sessions, enabling account takeover through malicious plugin or theme changelog content.
Affected Products
- Grav Admin plugin versions prior to 2.0.20
- Grav CMS installations that render third-party plugin or theme changelogs
- Grav Admin components MarkdownEditor and MarkdownModal
Discovery Timeline
- 2026-09-04 - CVE-2026-85601 published to NVD
- 2026-09-10 - Last updated in NVD database
Technical Details for CVE-2026-85601
Vulnerability Analysis
The vulnerability resides in how Grav Admin renders markdown content produced by the marked JavaScript library. The marked.parse() function converts markdown to HTML but does not, by itself, strip dangerous URI schemes such as javascript: from link targets. Grav Admin then passes this HTML directly to Svelte's {@html} directive inside the MarkdownEditor and MarkdownModal components. Because {@html} bypasses Svelte's automatic escaping, any script-bearing markup or anchor produced by marked reaches the DOM intact.
The attack surface is broader than a typical stored XSS. Grav renders changelogs from plugins and themes inside admin dialogs. An attacker who publishes a plugin or theme, or who supplies a changelog file consumed by a target site, can plant a payload that fires the moment an administrator opens the update or details view. The victim does not need to install the plugin, only view its metadata.
Root Cause
The root cause is missing output sanitization between markdown parsing and DOM insertion. Grav Admin trusts the HTML returned by marked.parse() and does not run it through a sanitizer such as DOMPurify before handing it to {@html}. Anchor href values are not filtered against an allowlist of safe URI schemes, so javascript: links pass through unchanged.
Attack Vector
An attacker crafts markdown in a plugin or theme changelog that includes a link using the javascript: scheme. When an administrator opens the changelog inside the Grav Admin interface, clicking or triggering the injected element executes attacker JavaScript in the origin of the Grav Admin panel. The script inherits the administrator's session and can create users, modify content, or install additional plugins. See the GitHub Security Advisory and the VulnCheck XSS Advisory for full technical detail.
Detection Methods for CVE-2026-85601
Indicators of Compromise
- Plugin or theme CHANGELOG.md files containing anchor links with javascript: URI schemes.
- Unexpected administrator account creations, permission changes, or plugin installations shortly after an admin viewed a changelog.
- Outbound requests from admin browsers to unfamiliar domains immediately after opening the Grav Admin update view.
Detection Strategies
- Scan installed and available Grav plugins and themes for changelog markdown containing the strings javascript:, data:text/html, or encoded variants such as javascript:.
- Inspect web server access logs for admin sessions that load plugin detail or update endpoints followed by anomalous POST activity to /admin/users, /admin/plugins, or /admin/config.
- Review browser Content Security Policy (CSP) violation reports, if configured, for inline script or unsafe URI events originating from admin pages.
Monitoring Recommendations
- Alert on administrator session activity that deviates from established baselines, including new user creation or file uploads within minutes of viewing third-party plugin metadata.
- Monitor the Grav user/plugins and user/themes directories for changes to blueprints.yaml and CHANGELOG.md files from untrusted sources.
- Forward Grav Admin web server logs into a centralized analytics platform so that admin actions can be correlated with changelog view events.
How to Mitigate CVE-2026-85601
Immediate Actions Required
- Upgrade the Grav Admin plugin to version 2.0.20 or later on all Grav installations.
- Audit currently installed plugins and themes and remove any obtained from untrusted sources.
- Rotate administrator credentials and invalidate active admin sessions if any suspicious changelog was viewed prior to patching.
Patch Information
Grav Admin 2.0.20 sanitizes markdown output before it reaches Svelte's {@html} directive in the MarkdownEditor and MarkdownModal components. Administrators should apply the update through the Grav Admin panel or via the command line using bin/gpm update admin. Details are available in the GitHub Security Advisory GHSA-752r-88j4-vxm3.
Workarounds
- Restrict administrator access to trusted IP ranges through web server or reverse proxy rules until the patch is applied.
- Disable browsing of third-party plugin and theme metadata within the admin interface until Grav Admin is upgraded.
- Deploy a strict Content Security Policy on the admin panel that forbids javascript: URI navigation and inline script execution.
# Configuration example
# Upgrade Grav Admin via the Grav Package Manager
cd /path/to/grav
bin/gpm update admin
# Verify the installed Admin plugin version
bin/gpm info admin | grep -i version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
