Grav XSS Vulnerability (CVE-2026-42612) Allows Publisher Account Takeover

The National Vulnerability Database has detailed CVE-2026-42612, a high-severity stored Cross-Site Scripting (XSS) vulnerability affecting Grav, a file-based web platform. This flaw, present in versions prior to 2.0.0-beta.2, allows authenticated publisher-level accounts to execute arbitrary JavaScript. The root cause is a blacklist bypass within the detectXss() function, specifically when processing unquoted HTML event attributes.

This isn’t just a minor annoyance; it’s a critical bypass. A publisher-level account gaining arbitrary JavaScript execution means full session hijacking, data exfiltration, or even further privilege escalation within the Grav environment. Attackers don’t need to be administrators; they just need a foothold at a publisher level, which is a significantly lower bar. The National Vulnerability Database assigns this a CVSS score of 8.5 (HIGH), underscoring the severity.

Defenders running Grav installations must prioritize patching. The fix is available in Grav version 2.0.0-beta.2. Given the ease of exploitation by a privileged user and the significant impact, leaving this unpatched is an invitation for internal compromise. Review your Grav deployment for any lingering older versions immediately.