The vulnerability in Grav v2.0.0 involves the XSS blueprint validator (Security::detectXss()) which inspects raw page content before Twig processing. When Twig content processing is enabled (twig_content.process_enabled: true), an attacker with page-write API permission can exploit Twig's string concatenation operator (~) to dynamically create event handler names, dangerous tags, or protocols at render time. The validator only sees the Twig expressions, which appear harmless, but after rendering, the output includes active payloads such as <img src=1 onerror=alert(1)>, enabling arbitrary JavaScript execution in users' browsers. This vulnerability is classified under CWE-79 and has a CVSS 3.1 score of 6.1 (medium severity).

Successful exploitation allows an attacker with page-write API permissions to inject malicious JavaScript that executes in the browsers of site visitors, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability affects confidentiality and integrity with limited impact on availability.

An official fix is available in Grav version 2.0.1. Users should upgrade from version 2.0.0 to 2.0.1 or later to remediate this vulnerability. No other mitigations are indicated by the vendor advisory.