GHSA-9pr6-8r9w-wvmj

Duplicate Advisory: Grav: detectXss() misses an event-handler attribute after an unpaired quote in an unquoted attribute value, giving stored XSS

Published

2026-08-18

Modified

2026-09-17

Sources

github-advisory

Summary

### Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-vfmf-q6x9-cw96. This link is maintained to preserve external references. ### Original Description Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the detectXss() function where unpaired quotes in unquoted attribute values bypass event-handler detection. Authenticated editors can inject event handlers like onerror= that pass validation and execute in visitor browsers when page content is rendered.

Affected packages

Remediation: No patched version is listed by GitHub.

References

• https://github.com/advisories/GHSA-9pr6-8r9w-wvmj