CyberRota Analysis
AI-GeneratedGrav Admin versions prior to 2.0.20 are vulnerable due to inadequate output sanitization from marked.parse(), allowing attackers to inject malicious JavaScript into the DOM through Svelte's {@html} directive in the MarkdownEditor and MarkdownModal components. This vulnerability enables the execution of arbitrary code in authenticated admin sessions, potentially compromising site integrity without direct access. Administrators of affected Grav installations should prioritize patching to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Grav Admin before 2.0.20 fails to sanitize output from marked.parse() before injecting it into the DOM via Svelte's {@html} directive in MarkdownEditor and MarkdownModal components. Attackers can inject javascript: URI schemes in plugin or theme changelogs to execute arbitrary code in authenticated admin sessions without requiring site access.