CyberRota Analysis
AI-GeneratedGrav Admin versions up to 2.0.19 are vulnerable to a stored cross-site scripting (XSS) attack due to improper handling of untrusted parameters in the tHtml() function, allowing attackers to inject malicious HTML through crafted usernames. This vulnerability can lead to the execution of arbitrary scripts in the context of an authenticated administrator session, potentially compromising sensitive administrative actions. Organizations using affected versions should prioritize upgrading to version 2.0.21 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Grav Admin (getgrav/grav-plugin-admin2) versions <= 2.0.19 contain a stored cross-site scripting vulnerability in the tHtml() function (src/lib/stores/i18n.svelte.ts), which substitutes untrusted parameters such as usernames into translation templates before parsing the result as markdown. Grav's server-side username validation (DataUser::isValidUsername) blocks filesystem-dangerous characters but not <, >, ", or ', allowing an attacker to register a username containing an HTML payload. When an administrator views a UI surface that renders the username through tHtml()—such as the two-factor force-disable confirmation prompt or the 'page is locked' editor notice—the payload executes in their authenticated session. Fixed in 2.0.21.