-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| getgrav/grav | composer | < 1.8.0-beta.27 | 1.8.0-beta.27 |
PHPPHPMiggo AIRoot Cause AnalysisThe vulnerability is a reflected Cross-Site Scripting (XSS) issue within the Grav admin panel, specifically affecting fields that use the selectize.js component for input. The root cause is the failure to properly sanitize user-provided data before it is rendered in the browser. The analysis of the patch 99f653296504f1d6408510dd2f6f20a45a26f9b0 reveals that the vulnerability is addressed by modifying the SelectizeField.init method in themes/grav/app/forms/fields/selectize.js. This function is responsible for initializing the selectize dropdowns. The patch introduces a SafeRender object with functions that explicitly escape HTML content for the items and options displayed in the dropdown. This SafeRender is now applied by default if no other custom renderer is specified. This indicates that, prior to the patch, the component would render raw HTML provided in parameters like data[header][content][items], allowing an attacker to inject and execute malicious scripts. Therefore, the SelectizeField.init function is the key location where the insecure component was configured, making it the primary indicator of this vulnerability in a runtime context.
SelectizeField.initthemes/grav/app/forms/fields/selectize.js
Ongoing coverage of React2Shell