-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| getgrav/grav | composer | < 1.8.0-beta.27 | 1.8.0-beta.27 |
Miggo AIRoot Cause AnalysisThe vulnerability is a stored Cross-Site Scripting (XSS) issue in the Grav Admin Plugin, specifically related to the handling of taxonomy names. The root cause is the failure to properly sanitize user-provided input before rendering it in the admin interface.
Injection Point: An attacker can inject a malicious script into a taxonomy name via the data[taxonomies] parameter on the POST /admin/config/site endpoint.
Vulnerable Rendering: The primary vulnerability is located in the themes/grav/templates/forms/fields/taxonomy/taxonomy.html.twig template. This template used the user-controlled taxonomy name to create a label, but failed to escape the HTML entities. The patch adds the |e (escape) filter in the Twig template to neutralize any embedded scripts.
Defense-in-Depth: A secondary, broader fix was implemented in the SelectizeField.init JavaScript function (themes/grav/app/forms/fields/selectize.js). This function is responsible for creating dropdowns. The patch ensures that all dropdown options are HTML-escaped by default, which prevents this and similar XSS vulnerabilities across the application where selectize.js is used for user-provided content.
During exploitation, a profiler would show the execution path leading to the rendering of the taxonomy.html.twig template. On the client-side, the SelectizeField.init function would be called to initialize the vulnerable dropdown component. Therefore, both the template and the JavaScript function are identified as key components related to the vulnerability.
taxonomy.html.twigthemes/grav/templates/forms/fields/taxonomy/taxonomy.html.twig
SelectizeField.initthemes/grav/app/forms/fields/selectize.js
A Semantic Attack on Google Gemini - Read the Latest Research