THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-85600 (MEDIUM 5.4) — Grav Admin (getgrav/grav-plugin-admin2) versions <= 2.0.19 contain a stored cross-site scripting vulnerability in the tHtml() function (src/lib/stores/i18n.svelte.ts), which substitutes untrusted parameters such as usernames into translation templates before parsing the result as

[NVD] CVE-2026-85600 (MEDIUM 5.4) — Grav Admin (getgrav/grav-plugin-admin2) versions <= 2.0.19 contain a stored cross-site scripting vulnerability in the tHtml() function (src/lib/stores/i18n.svelte.ts), which substitutes untrusted parameters such as usernames into translation templates before parsing the result as

mednvdPublished 2026-09-04

CVE-2026-85600 CVSS: 5.4 MEDIUM Published: 2026-09-04T12:17:23.630

Grav Admin (getgrav/grav-plugin-admin2) versions <= 2.0.19 contain a stored cross-site scripting vulnerability in the tHtml() function (src/lib/stores/i18n.svelte.ts), which substitutes untrusted parameters such as usernames into translation templates before parsing the result as markdown. Grav's server-side username validation (D

Indicators of compromise

CVE-2026-85600cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-85600