CVE-2026-42842

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-42842", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-30T16:44:48.376Z", "datePublished": "2026-05-11T15:29:36.490Z", "dateUpdated": "2026-05-11T18:25:09.488Z"}, "containers": {"cna": {"title": "grav-plugin-form: XSS via Taxonomy Field Values in Admin Panel", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/getgrav/grav/security/advisories/GHSA-c2q3-p4jr-c55f", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/getgrav/grav/security/advisories/GHSA-c2q3-p4jr-c55f"}, {"name": "https://github.com/getgrav/grav-plugin-form/commit/6bffb4c98be468a155d1656544ec45bb4a443957", "tags": ["x_refsource_MISC"], "url": "https://github.com/getgrav/grav-plugin-form/commit/6bffb4c98be468a155d1656544ec45bb4a443957"}], "affected": [{"vendor": "getgrav", "product": "grav", "versions": [{"version": "< 2.0.0-beta.2", "status": "affected"}]}, {"vendor": "getgrav", "product": "grav-plugin-form", "versions": [{"version": "< 9.1.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-11T15:29:36.490Z"}, "descriptions": [{"lang": "en", "value": "The form plugin for Grav adds the ability to create and use forms. Prior to 9.1.0, a Stored Cross-Site Scripting (XSS) vulnerability exists in the Grav CMS Form plugin's select field template. Taxonomy tag and category values are rendered with the Twig |raw filter in the admin panel, bypassing the global autoescape protection. An editor-level user can inject arbitrary JavaScript that executes in any administrator's browser session when they view or edit any page in the admin panel. This vulnerability is fixed in 9.1.0."}], "source": {"advisory": "GHSA-c2q3-p4jr-c55f", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/getgrav/grav/security/advisories/GHSA-c2q3-p4jr-c55f", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-11T18:24:43.410950Z", "id": "CVE-2026-42842", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-11T18:25:09.488Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-42842", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-11T18:24:43.410950Z"}}}], "references": [{"url": "https://github.com/getgrav/grav/security/advisories/GHSA-c2q3-p4jr-c55f", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-11T18:25:05.790Z"}}], "cna": {"title": "grav-plugin-form: XSS via Taxonomy Field Values in Admin Panel", "source": {"advisory": "GHSA-c2q3-p4jr-c55f", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "getgrav", "product": "grav", "versions": [{"status": "affected", "version": "< 2.0.0-beta.2"}]}, {"vendor": "getgrav", "product": "grav-plugin-form", "versions": [{"status": "affected", "version": "< 9.1.0"}]}], "references": [{"url": "https://github.com/getgrav/grav/security/advisories/GHSA-c2q3-p4jr-c55f", "name": "https://github.com/getgrav/grav/security/advisories/GHSA-c2q3-p4jr-c55f", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/getgrav/grav-plugin-form/commit/6bffb4c98be468a155d1656544ec45bb4a443957", "name": "https://github.com/getgrav/grav-plugin-form/commit/6bffb4c98be468a155d1656544ec45bb4a443957", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "The form plugin for Grav adds the ability to create and use forms. Prior to 9.1.0, a Stored Cross-Site Scripting (XSS) vulnerability exists in the Grav CMS Form plugin's select field template. Taxonomy tag and category values are rendered with the Twig |raw filter in the admin panel, bypassing the global autoescape protection. An editor-level user can inject arbitrary JavaScript that executes in any administrator's browser session when they view or edit any page in the admin panel. This vulnerability is fixed in 9.1.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-11T15:29:36.490Z"}}}, "cveMetadata": {"cveId": "CVE-2026-42842", "state": "PUBLISHED", "dateUpdated": "2026-05-11T18:25:09.488Z", "dateReserved": "2026-04-30T16:44:48.376Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-11T15:29:36.490Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "grav", "vendor": "getgrav", "versions": [{"status": "affected", "version": "< 2.0.0-beta.2"}]}, {"product": "grav-plugin-form", "vendor": "getgrav", "versions": [{"status": "affected", "version": "< 9.1.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The form plugin for Grav adds the ability to create and use forms. Prior to 9.1.0, a Stored Cross-Site Scripting (XSS) vulnerability exists in the Grav CMS Form plugin's select field template. Taxonomy tag and category values are rendered with the Twig |raw filter in the admin panel, bypassing the global autoescape protection. An editor-level user can inject arbitrary JavaScript that executes in any administrator's browser session when they view or edit any page in the admin panel. This vulnerability is fixed in 9.1.0."}, {"lang": "es", "value": "El plugin de formularios para Grav a\u00f1ade la capacidad de crear y usar formularios. Antes de 9.1.0, existe una vulnerabilidad de cross-site scripting (XSS) almacenado en la plantilla del campo de selecci\u00f3n del plugin de formularios de Grav CMS. Los valores de etiquetas de taxonom\u00eda y categor\u00eda se renderizan con el filtro Twig |raw en el panel de administraci\u00f3n, omitiendo la protecci\u00f3n global de autoescape. Un usuario con nivel de editor puede inyectar JavaScript arbitrario que se ejecuta en la sesi\u00f3n del navegador de cualquier administrador cuando ven o editan cualquier p\u00e1gina en el panel de administraci\u00f3n. Esta vulnerabilidad est\u00e1 corregida en 9.1.0."}], "id": "CVE-2026-42842", "lastModified": "2026-10-26T18:10:00.173", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42842", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-11T18:24:43.410950Z", "version": "2.0.3"}}]}, "published": "2026-05-11T17:16:33.873", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/getgrav/grav-plugin-form/commit/6bffb4c98be468a155d1656544ec45bb4a443957"}, {"source": "security-advisories@github.com", "url": "https://github.com/getgrav/grav/security/advisories/GHSA-c2q3-p4jr-c55f"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/getgrav/grav/security/advisories/GHSA-c2q3-p4jr-c55f"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.0.0-beta.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "grav", "source": "cna", "vendor": "getgrav"}, "product": "grav", "vendor": "getgrav"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,9.1.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "product": "grav-plugin-form", "vendor": "getgrav"}], "created": "2026-05-11T18:30:05.541564+00:00", "updated": "2026-05-12T09:23:06.498614+00:00", "vendors": ["getgrav", "getgrav$PRODUCT$grav", "getgrav$PRODUCT$grav-plugin-form"]}