Grav: detectXss() misses an event-handler attribute after an unpaired quote in an unquoted attribute value, giving stored XSS

Affected versions and vulnerable location - Confirmed on grav core at 78ebfc1 tag 2.0.13. - Detector: system/src/Grav/Common/Security.php:290, the onevents regex, run via patternMatches :315-330. - The onevents pattern at HEAD: "'??:\s\x00-\x20"'/|"^""|'^''on\sa-z+\s=iu - Sole save-time guard for...

Duplicate Advisory: Grav: detectXss() misses an event-handler attribute after an unpaired quote in an unquoted attribute value, giving stored XSS

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-vfmf-q6x9-cw96. This link is maintained to preserve external references. Original Description Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the detectXss function where unpaired quot...