Description

Grav Admin before 2.0.20 fails to sanitize output from marked.parse() before injecting it into the DOM via Svelte's {@html} directive in MarkdownEditor and MarkdownModal components. Attackers can inject javascript: URI schemes in plugin or theme changelogs to execute arbitrary code in authenticated admin sessions without requiring site access.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-09-04T12:17:23.763Z",
  "pubdate": "2026-09-04T12:17:23.763Z",
  "executiveSummary": "A Cross-Site Scripting (XSS) vulnerability exists in Grav Admin versions prior to 2.0.20, originating from the improper handling of user-supplied input.\nThe vulnerability manifests within the MarkdownEditor and MarkdownModal components, where output generated by marked.parse() is rendered directly into the DOM using Svelte's {@html} directive without prior sanitization.\nSuccessful exploitation allows an authenticated attacker to inject malicious javascript: URI schemes within plugin or theme changelogs.\nWhen a victim with administrative privileges interacts with the affected component, the injected script executes within the context of the user's active session.\nThis vulnerability poses a significant risk to administrative session integrity, potentially allowing an attacker to perform unauthorized administrative actions, exfiltrate sensitive data, or escalate privileges within the Grav environment.\nThe attack requires the adversary to have an authenticated admin session, emphasizing the need for robust input validation and output encoding mechanisms.",
  "technicalDetails": "The root cause of this vulnerability is the insecure use of Svelte's {@html} directive, which bypasses automatic template escaping. In the affected versions of Grav Admin, the MarkdownEditor and MarkdownModal components pass untrusted data processed by the marked.parse() library directly into this directive.\nThe marked.parse() function is designed to convert Markdown into HTML, but it does not inherently sanitize against all forms of malicious URI schemes, particularly when the resulting HTML is rendered without secondary sanitization. By crafting a Markdown payload that includes a javascript: URI—for example, within an anchor tag—an attacker can bypass the intended security controls.\nThe attack flow proceeds as follows: First, an attacker with authenticated administrative access navigates to a section where they can influence the content of a plugin or theme changelog. Second, the attacker inserts a payload containing a javascript: URI scheme, such as <a href='javascript:alert(1)'>Click me</a>, into the Markdown source.\nWhen the MarkdownEditor or MarkdownModal components process this input, they call marked.parse() and subsequently inject the resulting string directly into the DOM via the {@html} directive. Because the directive interprets the content as raw HTML, the browser renders the anchor tag with the executable JavaScript protocol.\nWhen an administrative user views the rendered changelog, clicking the link triggers the execution of the malicious JavaScript payload in the victim's browser. Because the script executes within the context of the authenticated admin session, it inherits the privileges of that user.\nThis behavior facilitates arbitrary code execution in the browser environment, enabling actions such as stealing session cookies, performing unauthorized configuration changes, or installing malicious plugins. As this vulnerability occurs within the admin interface, it inherently requires authentication; however, once inside, it provides a powerful vector for persistent compromise of the administrative interface."
}