Grav version 2.0.0 contains a cross-site scripting (XSS) vulnerability related to its blueprint validation process. The vulnerability arises when Twig content processing is enabled, allowing an attacker with page-write API permissions to bypass the XSS validator by using Twig string concatenation to construct malicious event handlers or tags dynamically. This results in arbitrary JavaScript execution in visitors' browsers. The issue was fixed in version 2.0.1.