PT-2026-84064

Summary Grav 2.0 renders editor-authored Twig in page content by default and relies on the Twig content sandbox to contain it. The shipped sandbox policy allowlists addcss and addjs on GravCommonAssets system/src/Grav/Common/Twig/Sandbox/SandboxDefaults.php:307. Because the sandbox arbitrates the...