PT-2026-94131

Summary The XSS blueprint validator Security::detectXss runs on the raw page content before Twig processing. An attacker can use Twig's string concatenation operator to dynamically construct an event handler name at render time. The validator sees "on" "error" - a harmless Twig expression - and...

Duplicate Advisory: Grav: XSS Blueprint Validation Bypass via Twig String Concatenation

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-2c4f-86xc-cr74. This link is maintained to preserve external references. Original Description Grav v2.0.0 contains a cross-site scripting vulnerability fixed in 2.0.1. The XSS blueprint validator...