The vulnerability in Grav arises from improper neutralization of input during web page generation, specifically in the Security::detectXss() function located in system/src/Grav/Common/Security.php. The detection mechanism anchors scanning at the '<' character and uses a pattern that cannot cross the first literal '>' character. However, if a '>' appears inside a quoted attribute value, browsers keep the tag open and parse subsequent event handlers such as 'onerror'. This discrepancy allows a page editor with limited privileges to inject stored XSS payloads (e.g., an image tag with an onerror alert) that are accepted, stored, and executed in the context of the site origin when any visitor views the page. The issue affects Grav versions from 1.5.2 up to and including 2.0.12 and is resolved in version 2.0.13.

An attacker with page editor privileges (without admin.super) can inject malicious scripts that execute in the browsers of any site visitors, including unauthenticated users. This can lead to theft of sensitive information, session hijacking, or other malicious actions within the site's origin context. The CVSS 4.0 base score is 5.1, indicating a medium severity vulnerability with network attack vector, low complexity, no privileges required beyond page editor, and user interaction needed.

Upgrade Grav to version 2.0.13 or later where this vulnerability is fixed. No other official remediation or temporary fixes are indicated. Until patched, restrict page editor privileges carefully and monitor for suspicious content submissions.