CVE-2026-75831
Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the audio and video media rendering through the sourceParsedownElement method. The media URL fragment is concatenated unescaped into rawHtml source elements, allowing attackers to inject arbitrary HTML and JavaScript that executes in viewers' sessions.
Debolezza
Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the audio and video media rendering through the sourceParsedownElement method. The media URL fragment is concatenated unescaped into rawHtml source elements, allowing attackers to inject arbitrary HTML and JavaScript that executes in viewers' sessions.
Riferimenti
- https://github.com/getgrav/grav/commit/aba291a59cab29ddce491175791888d8d0b65e20
- https://github.com/getgrav/grav/security/advisories/GHSA-6qw9-4vv5-jr97
- https://www.vulncheck.com/advisories/grav-before-stored-xss-via-audio-video-source-url
- https://github.com/getgrav/grav/security/advisories/GHSA-6qw9-4vv5-jr97
Trova il bug prima di un attaccante.
Accedi con GitHub e avvia il tuo primo audit in meno di un minuto. Il piano gratuito non richiede carta di credito.