LOWVulnerability
CVE-2026-86197
Grav before 2.0.20 contains a cross-site scripting vulnerability in the Twig sandbox policy that allowlists addJs and addCss methods on Grav\Common\Assets without proper output escaping. Page editors can inject arbitrary script by registering malicious assets or injecting attributes, which are rendered unescaped into document head tags and executed for all visitors including administrators.
Properties
- cve_id
- CVE-2026-86197
- signal_observed_at
- 2026-09-16T21:37:07+00:00
- published_at
- 2026-09-05T13:18:15.110
- last_modified
- 2026-09-10T16:18:02.173
Related Entities (2)
DESCRIBED_BY (1)
→[Source]NVD
HAS_WEAKNESS (1)
→[Weakness]Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Explore deeper with Ninja Signal's threat intelligence graph