CVE-2026-64628
Last modified
CVE-2026-64628 is a medium-severity vulnerability rated 5.4/10 on the CVSS scale. Grav contains a stored cross-site scripting vulnerability in shortcode-core attribute handlers where the XSS detection scan only matches payloads containing literal angle brackets, allowing shortcode parameters to bypass validation. Attackers with admin.pages permission can inject malicious JavaScript through shortcode attributes that execute in any viewer's browser, including administrators, enabling session hijacking via admin nonce theft.. EPSS estimates a 0.15% chance of exploitation in the next 30 days.
Description
Grav contains a stored cross-site scripting vulnerability in shortcode-core attribute handlers where the XSS detection scan only matches payloads containing literal angle brackets, allowing shortcode parameters to bypass validation. Attackers with admin.pages permission can inject malicious JavaScript through shortcode attributes that execute in any viewer's browser, including administrators, enabling session hijacking via admin nonce theft.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| getgrav | grav | <= 6.2.1 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-64628?
How severe is CVE-2026-64628?
How do I fix CVE-2026-64628?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-64622Network-AI (npm: network-ai) versions 5.12.2 through 5.13.3 …9.3
- CVE-2026-64623Network-AI before 5.13.4 contains an improper cryptographic …8.8
- CVE-2026-64624FreeRDP before 3.28.0 treats lines beginning with forward sl…8.5
- CVE-2026-64625AVideo before 29.0 contains an incomplete fix for CVE-2026-4…9.8
- CVE-2026-64626AVideo versions from commit 0dbadbca through latest master c…6.4
- CVE-2026-64627Parse Server versions >= 9.0.0 before 9.10.0-alpha.4 and ver…6.9
- CVE-2026-64629A vulnerability has been identified in Parasolid V38.0 (All …7.8
- CVE-2026-64630A vulnerability allowing a low-privileged user to retrieve r…5.3
- CVE-2026-64631A vulnerability allowing a low-privileged user to inject SQL…8.5
- CVE-2026-64633A vulnerability allowing remote unauthenticated code executi…10
- CVE-2026-64634A vulnerability allowing local privilege escalation to the R…8.4
- CVE-2026-64635Improper handling of the returnUrl parameter in the Forgot P…5.3
Are you affected by CVE-2026-64628?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST