GHSA-vfmf-q6x9-cw96: Grav: detectXss() misses an event-handler attribute after an unpaired quote in an unquoted attribute value, giving stored XSS
Summary
Grav's XSS (cross-site scripting, where malicious code runs in a visitor's browser) detection has a gap: when an unpaired quote appears inside an unquoted HTML attribute value, the detector's regex cannot advance past it to find event handlers like `onerror=`. This allows payloads like `<img src=x" onerror=alert(1)>` to pass through uncaught and execute in browsers. Non-super editors can save this malicious code to pages, where it runs for all visitors.
Solution / Mitigation
The source suggests three mitigation approaches: (1) modify the tag-body scan regex to treat quotes as delimiters only when they appear directly after `=` in an attribute, or normalize unquoted attribute values before scanning for handlers; (2) add detection for `on<name>=` sequences appearing after unbalanced quotes within the same tag; (3) encode `"` and `'` in stored non-super content, or change the default setting `markdown.escape_markup: true` for non-super authors. No specific version fix or patch is mentioned in the source.
Vulnerability Details
EPSS: 0.3%
Yes
September 17, 2026
Classification
Affected Packages
Original source: https://github.com/advisories/GHSA-vfmf-q6x9-cw96
First tracked: September 17, 2026 at 08:00 PM
Classified by LLM (prompt v3) · confidence: 95%