CVE-2026-85601: Getgrav Grav

Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days.

Grav Admin before 2.0.20 fails to sanitize output from marked.parse() before injecting it into the DOM via Svelte's {@html} directive in MarkdownEditor and MarkdownModal components. Attackers can inject javascript: URI schemes in plugin or theme changelogs to execute arbitrary code in authenticated admin sessions without requiring site access.

Affected products

• Getgrav Grav: before 2.0.20 (fixed in 2.0.20)

Published 2026-09-04. Last modified 2026-09-10.