CVE-2026-85600: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in getgrav grav-plugin-admin2

The vulnerability in Grav Admin (grav-plugin-admin2) is a stored cross-site scripting flaw in the tHtml() function located in src/lib/stores/i18n.svelte.ts. It improperly neutralizes input by substituting untrusted parameters such as usernames into translation templates before parsing the result as markdown. The server-side username validation (DataUser::isValidUsername) prevents filesystem-dangerous characters but does not filter out HTML special characters like <, >, ", or '. This allows an attacker to register a username containing an HTML payload. When an administrator views UI surfaces that render the username via tHtml(), such as the two-factor force-disable confirmation prompt or the 'page is locked' editor notice, the malicious payload executes in the administrator's authenticated session. The vulnerability is fixed in version 2.0.21.

An attacker can register a specially crafted username containing HTML/JavaScript code that executes in the context of an administrator's authenticated session when viewed in certain UI components. This can lead to session hijacking, unauthorized actions, or other impacts typical of stored XSS vulnerabilities. The CVSS 4.0 score is 5.1 (medium severity), reflecting network attack vector, low complexity, no privileges required, and user interaction needed.

Upgrade Grav Admin (grav-plugin-admin2) to version 2.0.21 or later, where this vulnerability is fixed. Patch status is not explicitly confirmed in the input data, but the description states the issue is fixed in 2.0.21. No other mitigations are indicated.