Grav before version 2.0.14 contains a stored XSS vulnerability in the Security::detectXss() function located in system/src/Grav/Common/Security.php. The issue is due to all XSS detection patterns using the PCRE /u (UTF-8) modifier, which causes preg_match() to return false if any invalid UTF-8 byte is present in the page content. This failure silently bypasses the save-time XSS safety gate (Validation::checkSafety()). An authenticated attacker with page-edit permissions but without the security.xss_whitelist privilege can exploit this to store malicious JavaScript that executes in the browser of any visitor viewing the compromised page.

An attacker with authenticated page-edit permissions can inject malicious JavaScript code into pages, which will execute in the browsers of visitors who view those pages. This can lead to typical XSS impacts such as session hijacking, defacement, or redirection to malicious sites. The vulnerability does not require elevated privileges beyond page-edit permissions and does not require user interaction beyond viewing the affected page.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict page-edit permissions to trusted users only and consider additional input validation or sanitization controls. Monitor official Grav project communications for updates on fixes.