# CVE-2026-86197: Grav cross-site scripting in Twig sandbox asset methods

Source: https://junglewise.ai/threats/cve-2026-86197-grav-cross-site-scripting-in-twig-sandbox-asset-methods  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-05. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-86197 · Severity: medium · CVSS 4 · Published 2026-09-05

Grav is a flat-file content management system used to publish websites. A vulnerability in versions before 2.0.20 allows page editors to inject malicious scripts that execute for all site visitors, including administrators. Attackers can exploit this to steal administrator credentials and gain full control of the website.

Technologies: [getgrav/grav (Packagist)](https://junglewise.ai/threats/technologies/getgrav-grav). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-86197 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-86197 being exploited in the wild.

**How severe is CVE-2026-86197?** Medium severity, with a CVSS score of 4, published 5 September 2026.

**Which products and versions are affected?** getgrav/grav (Packagist) ECOSYSTEM:introduced=0,fixed=2.0.20.

**Is there a fix for CVE-2026-86197?** Yes. getgrav/grav (Packagist): upgrade to 2.0.20 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-86197 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-86197?** Check whether you run getgrav/grav (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- getgrav/grav (Packagist): upgrade to 2.0.20 or later

  ```sh
  composer require getgrav/grav:^2.0.20
  ```


## Technical details

Grav 2.0's Twig content sandbox allowlists the addJs and addCss methods on Grav\Common\Assets without proper output escaping. A page editor with minimal privileges can call these methods to register arbitrary assets; the theme then emits them into the document head as <script> or <link> tags with unescaped URLs, allowing attribute breakout. The vulnerability bypasses the save-time XSS scanner because asset registration mutates a shared service and returns only a key, producing no markup for detection. Exploitation requires only page-edit rights and results in persistent script execution on the attacker's origin for all visitors, including administrators whose localStorage-stored JWT tokens can be exfiltrated for portable super-admin API access. Grav 2.0.20 removes addJs and addCss from the sandbox allowlist, and HTML-escapes asset URLs at all render sites; sites needing this functionality can re-add the methods via security.yaml configuration.

## Affected products

- Getgrav Grav before 2.0.20

## Identifiers

- CVE-2026-86197
- GHSA-8hgv-xc77-jmcr

## Timeline

- 2026-08-21: disclosed: Security advisory published on GitHub
- 2026-09-05: patched: Fix released in Grav 2.0.20
- 2026-09-05: advisory: CVE-2026-86197 assigned and published to NVD

## References

- [https://github.com/getgrav/grav/security/advisories/GHSA-8hgv-xc77-jmcr](https://github.com/getgrav/grav/security/advisories/GHSA-8hgv-xc77-jmcr)
- [https://www.vulncheck.com/advisories/grav-before-2.0.20-cross-site-scripting-via-assets-sandbox](https://www.vulncheck.com/advisories/grav-before-2.0.20-cross-site-scripting-via-assets-sandbox)

## Related threats

- [Grav Twig sandbox config exfiltration via offsetGet and dump filters](https://junglewise.ai/threats/cve-2026-61842-grav-twig-sandbox-config-exfiltration-via-offsetget-and-dump)
- [Grav ZipArchiver decompression bomb via missing extraction limits](https://junglewise.ai/threats/cve-2026-61690-grav-ziparchiver-decompression-bomb-via-missing-extraction-limits)
- [Grav incomplete Twig sandbox denylist information disclosure](https://junglewise.ai/threats/grav-incomplete-twig-sandbox-denylist-information-disclosure-e903bd3b)
- [Grav UserInterface offsetGet/offsetExists Twig sandbox bypass](https://junglewise.ai/threats/grav-userinterface-offsetget-offsetexists-twig-sandbox-bypass-f709468e)
- [Grav CMS origin validation bypass in referrer header](https://junglewise.ai/threats/grav-cms-origin-validation-bypass-in-referrer-header-0f775642)