Description

Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the audio and video media rendering through the sourceParsedownElement method. The media URL fragment is concatenated unescaped into rawHtml source elements, allowing attackers to inject arbitrary HTML and JavaScript that executes in viewers' sessions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.6",
  "pubDate": "2026-08-18T12:19:33.100Z",
  "pubdate": "2026-08-18T12:19:33.100Z",
  "executiveSummary": "Grav before 2.0.15 is susceptible to a stored cross-site scripting (XSS) vulnerability located within the audio and video media rendering mechanisms. Specifically, the flaw exists in the sourceParsedownElement method, which improperly handles media URL fragments during processing.\nThe root vulnerability enables malicious actors to inject arbitrary HTML and JavaScript payloads through crafted media URLs. When rendered, these malicious payloads are executed within the sessions of unsuspecting users viewing the affected content, leading to potential session hijacking, unauthorized actions, and exposure of sensitive data.\nThe risk implication is significant as it affects content rendering components where users might trust embedded media elements. Attackers require the capability to input or store malicious media links within the application, which are subsequently processed and served to other users.\nAffected systems are Grav installations prior to version 2.0.15. Remediation requires updating the software to version 2.0.15 or later to ensure proper sanitization and escaping of media URL fragments.",
  "technicalDetails": "The vulnerability resides in the Grav content management system, specifically affecting versions prior to 2.0.15. The core issue stems from insecure handling of data within the sourceParsedownElement method, which is responsible for processing and rendering audio and video media elements.\nThe root cause of the vulnerability is the unescaped concatenation of the media URL fragment directly into rawHtml source elements during the parsing process. Because the application fails to properly sanitize or encode user-supplied input contained within the media URL fragment, malicious input is treated as executable markup by the rendering engine rather than harmless string data.\nExploitation occurs when an attacker crafts a malicious media URL incorporating arbitrary HTML and JavaScript payloads within the fragment identifier. The attacker then injects this crafted URL into a context processed by Grav, such as a page, blog post, or comment where media rendering is triggered.\nWhen a victim views the affected page, the sourceParsedownElement method processes the malicious media URL and concatenates the unescaped fragment directly into the generated rawHtml source elements. The web browser subsequently interprets the injected markup, executing the arbitrary JavaScript within the security context of the viewer's session.\nThis stored cross-site scripting flaw allows attackers to perform actions on behalf of the victim, access session tokens, manipulate the Document Object Model (DOM) of the affected page, or exfiltrate sensitive information. The attack vector relies on the storage of the malicious input, meaning the payload persists and executes every time a user accesses the compromised media element."
}