CyberRota Analysis
AI-GeneratedGrav v2.0.0 is vulnerable to a cross-site scripting (XSS) attack due to improper validation of raw page content before Twig processing, allowing attackers with page-write API permissions to inject malicious scripts. The impact includes the execution of arbitrary JavaScript in users' browsers, potentially compromising user data and session integrity. Organizations using Grav v2.0.0 should prioritize upgrading to version 2.0.1 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Grav v2.0.0 contains a cross-site scripting vulnerability (fixed in 2.0.1). The XSS blueprint validator (Security::detectXss()) runs on raw page content before Twig processing. When Twig content processing is enabled (twig_content.process_enabled: true), an attacker with page-write API permission can use Twig's string concatenation operator (~) to dynamically construct event handler names, dangerous tag names, or dangerous protocols at render time (e.g. {% set x = "on" ~ "error" %}). The validator sees only the harmless Twig expression and allows the content, but after Twig rendering the output (rendered via {{ page.content|raw }}) contains an active payload such as <img src=1 onerror=alert(1)>, executing arbitrary JavaScript in visitors' browsers.