CVE-2026-85601

Grav Admin versions before 2.0.20 contain a cross-site scripting (XSS) vulnerability in the MarkdownEditor and MarkdownModal components. The root cause is unsanitized output from marked.parse() being injected into the DOM via Svelte's {@html} directive. Attackers can exploit this by injecting jav...

Cross-site Scripting (XSS)

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Cross-site Scripting XSS in the rendering of user-uploaded Office files as HTML using the Svelte @html directive without proper sanitization. An attacker can execute arbitrary JavaScript in the context of oth...