j0k3r/graby

Version	Released
`2.5.3` patch	Sep 14, 2026
`2.5.2` patch	Jul 07, 2026
`2.5.1` patch	Mar 27, 2026
`v2.5.0` minor 1 CVE	Sep 26, 2025
`2.4.6` patch 1 CVE	Feb 24, 2025
`2.4.5` patch 1 CVE	Jan 04, 2024
`2.4.4` patch 1 CVE	Mar 07, 2023
`2.4.3` patch 1 CVE	Feb 16, 2023
`2.4.2` patch 1 CVE	Nov 04, 2022
`2.4.1` minor 1 CVE	Feb 02, 2022
`2.3.5` patch 1 CVE	Jan 07, 2022
`2.3.4` patch 1 CVE	Jan 07, 2022
`2.3.3` patch 1 CVE	Dec 13, 2021
`2.3.2` patch 1 CVE	Oct 29, 2021
`2.3.1` patch 1 CVE	Oct 05, 2021
`2.3.0` minor 1 CVE	Jun 01, 2021
`2.2.7` patch 1 CVE	Apr 28, 2021
`2.2.6` patch 1 CVE	Apr 14, 2021
`2.2.5` patch 1 CVE	Jan 20, 2021
`2.2.4` patch 1 CVE	Jan 04, 2021
`v2.2.3` patch 1 CVE	Nov 30, 2020
`v2.2.2` patch 1 CVE	Jun 25, 2020
`2.2.1` patch 1 CVE	Jun 02, 2020
`2.2.0` minor 1 CVE	Apr 15, 2020
`2.1.1` patch 1 CVE	Jan 23, 2020
`2.1.0` minor 1 CVE	Nov 12, 2019
`2.0.2` patch 1 CVE	Jul 22, 2019
`2.0.1` patch 1 CVE	Jun 27, 2019
`2.0.0` major 1 CVE	May 22, 2019
`1.20.1` patch 1 CVE	May 14, 2019
`1.20.0` minor 1 CVE	May 11, 2019
`1.19.1` patch 1 CVE	Feb 13, 2019
`2.0.0-alpha.0` pre 1 CVE	Jan 26, 2019
`1.19.0` minor 1 CVE	Jan 22, 2019
`1.18.1` patch 1 CVE	Jan 21, 2019
`1.18.0` minor 1 CVE	Jan 08, 2019
`1.17.0` minor 1 CVE	Jan 07, 2019
`1.16.0` minor 1 CVE	Jan 04, 2019
`1.15.5` patch 1 CVE	Dec 04, 2018
`1.15.4` patch 1 CVE	Nov 07, 2018
`1.15.3` patch 1 CVE	Nov 01, 2018
`1.15.2` patch 1 CVE	Nov 01, 2018
`1.15.1` patch 1 CVE	Nov 01, 2018
`1.15.0` minor 1 CVE	Oct 29, 2018
`1.14.0` minor 1 CVE	Oct 01, 2018
`1.13.6` patch 1 CVE	Aug 31, 2018
`1.13.5` patch 1 CVE	Jul 28, 2018
`1.13.4` patch 1 CVE	Jun 11, 2018
`1.13.3` patch 1 CVE	Jun 08, 2018
`1.13.2` patch 1 CVE	Jun 06, 2018

2.5.3 patch

Sep 14, 2026

2.5.2 patch

Jul 07, 2026

2.5.1 patch

Mar 27, 2026

v2.5.0 minor

1 CVE

GHSA-3h6j-9x8m-rg3g Mar 31, 2026

Graby has stored XSS via iframe srcdoc Attribute in htmLawed Sanitization Config

Low

Network Low None

Summary

Graby's cleanupXss() function configures htmLawed with conflicting settings: safe=1 (which removes <iframe>) combined with 'elements' => '*+iframe-meta' (which re-enables <iframe>). htmLawed does not sanitize the srcdoc attribute, allowing injection of arbitrary JavaScript that executes when the content is rendered via |raw in templates.

Root Cause

src/Graby.php lines 1038-1048:

htmLawed($html, [
    'safe' => 1,                    // removes <iframe>
    'elements' => '*+iframe-meta',  // re-adds <iframe>, overrides safe=1
    'deny_attribute' => 'style',    // srcdoc is NOT denied
]);

The safe=1 and +iframe combination is a conflict: safe mode is designed to strip dangerous elements, but the elements override re-enables <iframe> without also blocking the dangerous srcdoc attribute.

Proof of Concept

Input to cleanupXss():

<iframe srcdoc="&lt;script&gt;alert(document.domain)&lt;/script&gt;"></iframe>

Output (unchanged — htmLawed passes it through):

<iframe srcdoc="&lt;script&gt;alert(document.domain)&lt;/script&gt;"></iframe>

When rendered via {{ content|raw }} in a template, srcdoc executes in an about:srcdoc frame with the same origin as the page. Confirmed via Puppeteer/Chromium headless: alert(document.domain) fires.

Validated on Wallabag (which uses Graby) via Docker: entry created via API with iframe-only content body triggers Readability failure → falls through to cleanupXss() path.

Impact

Stored XSS in any application rendering Graby-sanitized content via |raw
In Wallabag: affects both authenticated views and public share pages (unauthenticated)
No CSP headers in default Wallabag config — no secondary mitigation

Suggested Fix

Either remove +iframe from the elements config to keep iframes blocked:

'elements' => '*-iframe-meta',

Or explicitly deny the srcdoc attribute:

'deny_attribute' => 'style srcdoc',

Credit

Discovered by @tikket1, 2026-03-25. Redirected from wallabag/wallabag advisory by @j0k3r.

Affected versions


          1.0.0


          1.0.0-alpha.0


          1.0.0-alpha.1


          1.0.0-alpha.2


          1.0.1


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.0.6


          1.0.7


          1.0.8

+ 82 more


            1.1.0


            1.10.0


            1.10.1


            1.11.0


            1.11.1


            1.12.0


            1.12.1


            1.13.0


            1.13.1


            1.13.2


            1.13.3


            1.13.4


            1.13.5


            1.13.6


            1.14.0


            1.15.0


            1.15.1


            1.15.2


            1.15.3


            1.15.4


            1.15.5


            1.16.0


            1.17.0


            1.18.0


            1.18.1


            1.19.0


            1.19.1


            1.2.0


            1.20.0


            1.20.1


            1.3.0


            1.4.0


            1.4.1


            1.4.2


            1.4.3


            1.4.4


            1.4.5


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.4


            1.6.0


            1.6.1


            1.6.2


            1.7.0


            1.7.1


            1.8.0


            1.8.1


            1.8.2


            1.9.0


            1.9.1


            1.9.2


            1.9.3


            2.0.0


            2.0.0-alpha.0


            2.0.1


            2.0.2


            2.1.0


            2.1.1


            2.2.0


            2.2.1


            2.2.4


            2.2.5


            2.2.6


            2.2.7


            2.3.0


            2.3.1


            2.3.2


            2.3.3


            2.3.4


            2.3.5


            2.4.0


            2.4.1


            2.4.2


            2.4.3


            2.4.4


            2.4.5


            2.4.6


            v2.2.2


            v2.2.3


            v2.5.0

Fixed in


          2.5.1

References

Updated Mar 31, 2026 · Source: OSV.dev

Sep 26, 2025

2.4.6 patch

1 CVE

GHSA-3h6j-9x8m-rg3g Mar 31, 2026

Graby has stored XSS via iframe srcdoc Attribute in htmLawed Sanitization Config

Low

Network Low None

Summary

Graby's cleanupXss() function configures htmLawed with conflicting settings: safe=1 (which removes <iframe>) combined with 'elements' => '*+iframe-meta' (which re-enables <iframe>). htmLawed does not sanitize the srcdoc attribute, allowing injection of arbitrary JavaScript that executes when the content is rendered via |raw in templates.

Root Cause

src/Graby.php lines 1038-1048:

htmLawed($html, [
    'safe' => 1,                    // removes <iframe>
    'elements' => '*+iframe-meta',  // re-adds <iframe>, overrides safe=1
    'deny_attribute' => 'style',    // srcdoc is NOT denied
]);

The safe=1 and +iframe combination is a conflict: safe mode is designed to strip dangerous elements, but the elements override re-enables <iframe> without also blocking the dangerous srcdoc attribute.

Proof of Concept

Input to cleanupXss():

<iframe srcdoc="&lt;script&gt;alert(document.domain)&lt;/script&gt;"></iframe>

Output (unchanged — htmLawed passes it through):

<iframe srcdoc="&lt;script&gt;alert(document.domain)&lt;/script&gt;"></iframe>

When rendered via {{ content|raw }} in a template, srcdoc executes in an about:srcdoc frame with the same origin as the page. Confirmed via Puppeteer/Chromium headless: alert(document.domain) fires.

Validated on Wallabag (which uses Graby) via Docker: entry created via API with iframe-only content body triggers Readability failure → falls through to cleanupXss() path.

Impact

Stored XSS in any application rendering Graby-sanitized content via |raw
In Wallabag: affects both authenticated views and public share pages (unauthenticated)
No CSP headers in default Wallabag config — no secondary mitigation

Suggested Fix

Either remove +iframe from the elements config to keep iframes blocked:

'elements' => '*-iframe-meta',

Or explicitly deny the srcdoc attribute:

'deny_attribute' => 'style srcdoc',

Credit

Discovered by @tikket1, 2026-03-25. Redirected from wallabag/wallabag advisory by @j0k3r.

Affected versions


          1.0.0


          1.0.0-alpha.0


          1.0.0-alpha.1


          1.0.0-alpha.2


          1.0.1


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.0.6


          1.0.7


          1.0.8

+ 82 more


            1.1.0


            1.10.0


            1.10.1


            1.11.0


            1.11.1


            1.12.0


            1.12.1


            1.13.0


            1.13.1


            1.13.2


            1.13.3


            1.13.4


            1.13.5


            1.13.6


            1.14.0


            1.15.0


            1.15.1


            1.15.2


            1.15.3


            1.15.4


            1.15.5


            1.16.0


            1.17.0


            1.18.0


            1.18.1


            1.19.0


            1.19.1


            1.2.0


            1.20.0


            1.20.1


            1.3.0


            1.4.0


            1.4.1


            1.4.2


            1.4.3


            1.4.4


            1.4.5


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.4


            1.6.0


            1.6.1


            1.6.2


            1.7.0


            1.7.1


            1.8.0


            1.8.1


            1.8.2


            1.9.0


            1.9.1


            1.9.2


            1.9.3


            2.0.0


            2.0.0-alpha.0


            2.0.1


            2.0.2


            2.1.0


            2.1.1


            2.2.0


            2.2.1


            2.2.4


            2.2.5


            2.2.6


            2.2.7


            2.3.0


            2.3.1


            2.3.2


            2.3.3


            2.3.4


            2.3.5


            2.4.0


            2.4.1


            2.4.2


            2.4.3


            2.4.4


            2.4.5


            2.4.6


            v2.2.2


            v2.2.3


            v2.5.0

Fixed in


          2.5.1

References

Updated Mar 31, 2026 · Source: OSV.dev

Feb 24, 2025

2.4.5 patch

1 CVE

GHSA-3h6j-9x8m-rg3g Mar 31, 2026

Graby has stored XSS via iframe srcdoc Attribute in htmLawed Sanitization Config

Low

Network Low None

Summary

Graby's cleanupXss() function configures htmLawed with conflicting settings: safe=1 (which removes <iframe>) combined with 'elements' => '*+iframe-meta' (which re-enables <iframe>). htmLawed does not sanitize the srcdoc attribute, allowing injection of arbitrary JavaScript that executes when the content is rendered via |raw in templates.

Root Cause

src/Graby.php lines 1038-1048:

htmLawed($html, [
    'safe' => 1,                    // removes <iframe>
    'elements' => '*+iframe-meta',  // re-adds <iframe>, overrides safe=1
    'deny_attribute' => 'style',    // srcdoc is NOT denied
]);

The safe=1 and +iframe combination is a conflict: safe mode is designed to strip dangerous elements, but the elements override re-enables <iframe> without also blocking the dangerous srcdoc attribute.

Proof of Concept

Input to cleanupXss():

<iframe srcdoc="&lt;script&gt;alert(document.domain)&lt;/script&gt;"></iframe>

Output (unchanged — htmLawed passes it through):

<iframe srcdoc="&lt;script&gt;alert(document.domain)&lt;/script&gt;"></iframe>

When rendered via {{ content|raw }} in a template, srcdoc executes in an about:srcdoc frame with the same origin as the page. Confirmed via Puppeteer/Chromium headless: alert(document.domain) fires.

Validated on Wallabag (which uses Graby) via Docker: entry created via API with iframe-only content body triggers Readability failure → falls through to cleanupXss() path.

Impact

Stored XSS in any application rendering Graby-sanitized content via |raw
In Wallabag: affects both authenticated views and public share pages (unauthenticated)
No CSP headers in default Wallabag config — no secondary mitigation

Suggested Fix

Either remove +iframe from the elements config to keep iframes blocked:

'elements' => '*-iframe-meta',

Or explicitly deny the srcdoc attribute:

'deny_attribute' => 'style srcdoc',

Credit

Discovered by @tikket1, 2026-03-25. Redirected from wallabag/wallabag advisory by @j0k3r.

Affected versions


          1.0.0


          1.0.0-alpha.0


          1.0.0-alpha.1


          1.0.0-alpha.2


          1.0.1


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.0.6


          1.0.7


          1.0.8

+ 82 more


            1.1.0


            1.10.0


            1.10.1


            1.11.0


            1.11.1


            1.12.0


            1.12.1


            1.13.0


            1.13.1


            1.13.2


            1.13.3


            1.13.4


            1.13.5


            1.13.6


            1.14.0


            1.15.0


            1.15.1


            1.15.2


            1.15.3


            1.15.4


            1.15.5


            1.16.0


            1.17.0


            1.18.0


            1.18.1


            1.19.0


            1.19.1


            1.2.0


            1.20.0


            1.20.1


            1.3.0


            1.4.0


            1.4.1


            1.4.2


            1.4.3


            1.4.4


            1.4.5


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.4


            1.6.0


            1.6.1


            1.6.2


            1.7.0


            1.7.1


            1.8.0


            1.8.1


            1.8.2


            1.9.0


            1.9.1


            1.9.2


            1.9.3


            2.0.0


            2.0.0-alpha.0


            2.0.1


            2.0.2


            2.1.0


            2.1.1


            2.2.0


            2.2.1


            2.2.4


            2.2.5


            2.2.6


            2.2.7


            2.3.0


            2.3.1


            2.3.2


            2.3.3


            2.3.4


            2.3.5


            2.4.0


            2.4.1


            2.4.2


            2.4.3


            2.4.4


            2.4.5


            2.4.6


            v2.2.2


            v2.2.3


            v2.5.0

Fixed in


          2.5.1

References

Updated Mar 31, 2026 · Source: OSV.dev

Jan 04, 2024

2.4.4 patch

1 CVE

GHSA-3h6j-9x8m-rg3g Mar 31, 2026

Graby has stored XSS via iframe srcdoc Attribute in htmLawed Sanitization Config

Low

Network Low None

Summary

Graby's cleanupXss() function configures htmLawed with conflicting settings: safe=1 (which removes <iframe>) combined with 'elements' => '*+iframe-meta' (which re-enables <iframe>). htmLawed does not sanitize the srcdoc attribute, allowing injection of arbitrary JavaScript that executes when the content is rendered via |raw in templates.

Root Cause

src/Graby.php lines 1038-1048:

htmLawed($html, [
    'safe' => 1,                    // removes <iframe>
    'elements' => '*+iframe-meta',  // re-adds <iframe>, overrides safe=1
    'deny_attribute' => 'style',    // srcdoc is NOT denied
]);

The safe=1 and +iframe combination is a conflict: safe mode is designed to strip dangerous elements, but the elements override re-enables <iframe> without also blocking the dangerous srcdoc attribute.

Proof of Concept

Input to cleanupXss():

<iframe srcdoc="&lt;script&gt;alert(document.domain)&lt;/script&gt;"></iframe>

Output (unchanged — htmLawed passes it through):

<iframe srcdoc="&lt;script&gt;alert(document.domain)&lt;/script&gt;"></iframe>

When rendered via {{ content|raw }} in a template, srcdoc executes in an about:srcdoc frame with the same origin as the page. Confirmed via Puppeteer/Chromium headless: alert(document.domain) fires.

Validated on Wallabag (which uses Graby) via Docker: entry created via API with iframe-only content body triggers Readability failure → falls through to cleanupXss() path.

Impact

Stored XSS in any application rendering Graby-sanitized content via |raw
In Wallabag: affects both authenticated views and public share pages (unauthenticated)
No CSP headers in default Wallabag config — no secondary mitigation

Suggested Fix

Either remove +iframe from the elements config to keep iframes blocked:

'elements' => '*-iframe-meta',

Or explicitly deny the srcdoc attribute:

'deny_attribute' => 'style srcdoc',

Credit

Discovered by @tikket1, 2026-03-25. Redirected from wallabag/wallabag advisory by @j0k3r.

Affected versions


          1.0.0


          1.0.0-alpha.0


          1.0.0-alpha.1


          1.0.0-alpha.2


          1.0.1


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.0.6


          1.0.7


          1.0.8

+ 82 more


            1.1.0


            1.10.0


            1.10.1


            1.11.0


            1.11.1


            1.12.0


            1.12.1


            1.13.0


            1.13.1


            1.13.2


            1.13.3


            1.13.4


            1.13.5


            1.13.6


            1.14.0


            1.15.0


            1.15.1


            1.15.2


            1.15.3


            1.15.4


            1.15.5


            1.16.0


            1.17.0


            1.18.0


            1.18.1


            1.19.0


            1.19.1


            1.2.0


            1.20.0


            1.20.1


            1.3.0


            1.4.0


            1.4.1


            1.4.2


            1.4.3


            1.4.4


            1.4.5


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.4


            1.6.0


            1.6.1


            1.6.2


            1.7.0


            1.7.1


            1.8.0


            1.8.1


            1.8.2


            1.9.0


            1.9.1


            1.9.2


            1.9.3


            2.0.0


            2.0.0-alpha.0


            2.0.1


            2.0.2


            2.1.0


            2.1.1


            2.2.0


            2.2.1


            2.2.4


            2.2.5


            2.2.6


            2.2.7


            2.3.0


            2.3.1


            2.3.2


            2.3.3


            2.3.4


            2.3.5


            2.4.0


            2.4.1


            2.4.2


            2.4.3


            2.4.4


            2.4.5


            2.4.6


            v2.2.2


            v2.2.3


            v2.5.0

Fixed in


          2.5.1

References

Updated Mar 31, 2026 · Source: OSV.dev

Mar 07, 2023

2.4.3 patch

1 CVE

GHSA-3h6j-9x8m-rg3g Mar 31, 2026

Graby has stored XSS via iframe srcdoc Attribute in htmLawed Sanitization Config

Low

Network Low None

Summary

Graby's cleanupXss() function configures htmLawed with conflicting settings: safe=1 (which removes <iframe>) combined with 'elements' => '*+iframe-meta' (which re-enables <iframe>). htmLawed does not sanitize the srcdoc attribute, allowing injection of arbitrary JavaScript that executes when the content is rendered via |raw in templates.

Root Cause

src/Graby.php lines 1038-1048:

htmLawed($html, [
    'safe' => 1,                    // removes <iframe>
    'elements' => '*+iframe-meta',  // re-adds <iframe>, overrides safe=1
    'deny_attribute' => 'style',    // srcdoc is NOT denied
]);

The safe=1 and +iframe combination is a conflict: safe mode is designed to strip dangerous elements, but the elements override re-enables <iframe> without also blocking the dangerous srcdoc attribute.

Proof of Concept

Input to cleanupXss():

<iframe srcdoc="&lt;script&gt;alert(document.domain)&lt;/script&gt;"></iframe>

Output (unchanged — htmLawed passes it through):

<iframe srcdoc="&lt;script&gt;alert(document.domain)&lt;/script&gt;"></iframe>

When rendered via {{ content|raw }} in a template, srcdoc executes in an about:srcdoc frame with the same origin as the page. Confirmed via Puppeteer/Chromium headless: alert(document.domain) fires.

Validated on Wallabag (which uses Graby) via Docker: entry created via API with iframe-only content body triggers Readability failure → falls through to cleanupXss() path.

Impact

Stored XSS in any application rendering Graby-sanitized content via |raw
In Wallabag: affects both authenticated views and public share pages (unauthenticated)
No CSP headers in default Wallabag config — no secondary mitigation

Suggested Fix

Either remove +iframe from the elements config to keep iframes blocked:

'elements' => '*-iframe-meta',

Or explicitly deny the srcdoc attribute:

'deny_attribute' => 'style srcdoc',

Credit

Discovered by @tikket1, 2026-03-25. Redirected from wallabag/wallabag advisory by @j0k3r.

Affected versions


          1.0.0


          1.0.0-alpha.0


          1.0.0-alpha.1


          1.0.0-alpha.2


          1.0.1


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.0.6


          1.0.7


          1.0.8

+ 82 more


            1.1.0


            1.10.0


            1.10.1


            1.11.0


            1.11.1


            1.12.0


            1.12.1


            1.13.0


            1.13.1


            1.13.2


            1.13.3


            1.13.4


            1.13.5


            1.13.6


            1.14.0


            1.15.0


            1.15.1


            1.15.2


            1.15.3


            1.15.4


            1.15.5


            1.16.0


            1.17.0


            1.18.0


            1.18.1


            1.19.0


            1.19.1


            1.2.0


            1.20.0


            1.20.1


            1.3.0


            1.4.0


            1.4.1


            1.4.2


            1.4.3


            1.4.4


            1.4.5


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.4


            1.6.0


            1.6.1


            1.6.2


            1.7.0


            1.7.1


            1.8.0


            1.8.1


            1.8.2


            1.9.0


            1.9.1


            1.9.2


            1.9.3


            2.0.0


            2.0.0-alpha.0


            2.0.1


            2.0.2


            2.1.0


            2.1.1


            2.2.0


            2.2.1


            2.2.4


            2.2.5


            2.2.6


            2.2.7


            2.3.0


            2.3.1


            2.3.2


            2.3.3


            2.3.4


            2.3.5


            2.4.0


            2.4.1


            2.4.2


            2.4.3


            2.4.4


            2.4.5


            2.4.6


            v2.2.2


            v2.2.3


            v2.5.0

Fixed in


          2.5.1

References

Updated Mar 31, 2026 · Source: OSV.dev

Feb 16, 2023

2.4.2 patch

1 CVE

GHSA-3h6j-9x8m-rg3g Mar 31, 2026

Graby has stored XSS via iframe srcdoc Attribute in htmLawed Sanitization Config

Low

Network Low None

Summary

Graby's cleanupXss() function configures htmLawed with conflicting settings: safe=1 (which removes <iframe>) combined with 'elements' => '*+iframe-meta' (which re-enables <iframe>). htmLawed does not sanitize the srcdoc attribute, allowing injection of arbitrary JavaScript that executes when the content is rendered via |raw in templates.

Root Cause

src/Graby.php lines 1038-1048:

htmLawed($html, [
    'safe' => 1,                    // removes <iframe>
    'elements' => '*+iframe-meta',  // re-adds <iframe>, overrides safe=1
    'deny_attribute' => 'style',    // srcdoc is NOT denied
]);

The safe=1 and +iframe combination is a conflict: safe mode is designed to strip dangerous elements, but the elements override re-enables <iframe> without also blocking the dangerous srcdoc attribute.

Proof of Concept

Input to cleanupXss():

<iframe srcdoc="&lt;script&gt;alert(document.domain)&lt;/script&gt;"></iframe>

Output (unchanged — htmLawed passes it through):

<iframe srcdoc="&lt;script&gt;alert(document.domain)&lt;/script&gt;"></iframe>

When rendered via {{ content|raw }} in a template, srcdoc executes in an about:srcdoc frame with the same origin as the page. Confirmed via Puppeteer/Chromium headless: alert(document.domain) fires.

Validated on Wallabag (which uses Graby) via Docker: entry created via API with iframe-only content body triggers Readability failure → falls through to cleanupXss() path.

Impact

Stored XSS in any application rendering Graby-sanitized content via |raw
In Wallabag: affects both authenticated views and public share pages (unauthenticated)
No CSP headers in default Wallabag config — no secondary mitigation

Suggested Fix

Either remove +iframe from the elements config to keep iframes blocked:

'elements' => '*-iframe-meta',

Or explicitly deny the srcdoc attribute:

'deny_attribute' => 'style srcdoc',

Credit

Discovered by @tikket1, 2026-03-25. Redirected from wallabag/wallabag advisory by @j0k3r.

Affected versions


          1.0.0


          1.0.0-alpha.0


          1.0.0-alpha.1


          1.0.0-alpha.2


          1.0.1


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.0.6


          1.0.7


          1.0.8

+ 82 more


            1.1.0


            1.10.0


            1.10.1


            1.11.0


            1.11.1


            1.12.0


            1.12.1


            1.13.0


            1.13.1


            1.13.2


            1.13.3


            1.13.4


            1.13.5


            1.13.6


            1.14.0


            1.15.0


            1.15.1


            1.15.2


            1.15.3


            1.15.4


            1.15.5


            1.16.0


            1.17.0


            1.18.0


            1.18.1


            1.19.0


            1.19.1


            1.2.0


            1.20.0


            1.20.1


            1.3.0


            1.4.0


            1.4.1


            1.4.2


            1.4.3


            1.4.4


            1.4.5


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.4


            1.6.0


            1.6.1


            1.6.2


            1.7.0


            1.7.1


            1.8.0


            1.8.1


            1.8.2


            1.9.0


            1.9.1


            1.9.2


            1.9.3


            2.0.0


            2.0.0-alpha.0


            2.0.1


            2.0.2


            2.1.0


            2.1.1


            2.2.0


            2.2.1


            2.2.4


            2.2.5


            2.2.6


            2.2.7


            2.3.0


            2.3.1


            2.3.2


            2.3.3


            2.3.4


            2.3.5


            2.4.0


            2.4.1


            2.4.2


            2.4.3


            2.4.4


            2.4.5


            2.4.6


            v2.2.2


            v2.2.3


            v2.5.0

Fixed in


          2.5.1

References

Updated Mar 31, 2026 · Source: OSV.dev

Nov 04, 2022

2.4.1 minor

1 CVE

GHSA-3h6j-9x8m-rg3g Mar 31, 2026

Graby has stored XSS via iframe srcdoc Attribute in htmLawed Sanitization Config

Low

Network Low None

Summary

Graby's cleanupXss() function configures htmLawed with conflicting settings: safe=1 (which removes <iframe>) combined with 'elements' => '*+iframe-meta' (which re-enables <iframe>). htmLawed does not sanitize the srcdoc attribute, allowing injection of arbitrary JavaScript that executes when the content is rendered via |raw in templates.

Root Cause

src/Graby.php lines 1038-1048:

htmLawed($html, [
    'safe' => 1,                    // removes <iframe>
    'elements' => '*+iframe-meta',  // re-adds <iframe>, overrides safe=1
    'deny_attribute' => 'style',    // srcdoc is NOT denied
]);

The safe=1 and +iframe combination is a conflict: safe mode is designed to strip dangerous elements, but the elements override re-enables <iframe> without also blocking the dangerous srcdoc attribute.

Proof of Concept

Input to cleanupXss():

<iframe srcdoc="&lt;script&gt;alert(document.domain)&lt;/script&gt;"></iframe>

Output (unchanged — htmLawed passes it through):

<iframe srcdoc="&lt;script&gt;alert(document.domain)&lt;/script&gt;"></iframe>

When rendered via {{ content|raw }} in a template, srcdoc executes in an about:srcdoc frame with the same origin as the page. Confirmed via Puppeteer/Chromium headless: alert(document.domain) fires.

Validated on Wallabag (which uses Graby) via Docker: entry created via API with iframe-only content body triggers Readability failure → falls through to cleanupXss() path.

Impact

Stored XSS in any application rendering Graby-sanitized content via |raw
In Wallabag: affects both authenticated views and public share pages (unauthenticated)
No CSP headers in default Wallabag config — no secondary mitigation

Suggested Fix

Either remove +iframe from the elements config to keep iframes blocked:

'elements' => '*-iframe-meta',

Or explicitly deny the srcdoc attribute:

'deny_attribute' => 'style srcdoc',

Credit

Discovered by @tikket1, 2026-03-25. Redirected from wallabag/wallabag advisory by @j0k3r.

Affected versions


          1.0.0


          1.0.0-alpha.0


          1.0.0-alpha.1


          1.0.0-alpha.2


          1.0.1


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.0.6


          1.0.7


          1.0.8

+ 82 more


            1.1.0


            1.10.0


            1.10.1


            1.11.0


            1.11.1


            1.12.0


            1.12.1


            1.13.0


            1.13.1


            1.13.2


            1.13.3


            1.13.4


            1.13.5


            1.13.6


            1.14.0


            1.15.0


            1.15.1


            1.15.2


            1.15.3


            1.15.4


            1.15.5


            1.16.0


            1.17.0


            1.18.0


            1.18.1


            1.19.0


            1.19.1


            1.2.0


            1.20.0


            1.20.1


            1.3.0


            1.4.0


            1.4.1


            1.4.2


            1.4.3


            1.4.4


            1.4.5


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.4


            1.6.0


            1.6.1


            1.6.2


            1.7.0


            1.7.1


            1.8.0


            1.8.1


            1.8.2


            1.9.0


            1.9.1


            1.9.2


            1.9.3


            2.0.0


            2.0.0-alpha.0


            2.0.1


            2.0.2


            2.1.0


            2.1.1


            2.2.0


            2.2.1


            2.2.4


            2.2.5


            2.2.6


            2.2.7


            2.3.0


            2.3.1


            2.3.2


            2.3.3


            2.3.4


            2.3.5


            2.4.0


            2.4.1


            2.4.2


            2.4.3


            2.4.4


            2.4.5


            2.4.6


            v2.2.2


            v2.2.3


            v2.5.0

Fixed in


          2.5.1

References

Updated Mar 31, 2026 · Source: OSV.dev

Feb 02, 2022

2.3.5 patch

1 CVE

GHSA-3h6j-9x8m-rg3g Mar 31, 2026

Graby has stored XSS via iframe srcdoc Attribute in htmLawed Sanitization Config

Low

Network Low None

Summary

Graby's cleanupXss() function configures htmLawed with conflicting settings: safe=1 (which removes <iframe>) combined with 'elements' => '*+iframe-meta' (which re-enables <iframe>). htmLawed does not sanitize the srcdoc attribute, allowing injection of arbitrary JavaScript that executes when the content is rendered via |raw in templates.

Root Cause

src/Graby.php lines 1038-1048:

htmLawed($html, [
    'safe' => 1,                    // removes <iframe>
    'elements' => '*+iframe-meta',  // re-adds <iframe>, overrides safe=1
    'deny_attribute' => 'style',    // srcdoc is NOT denied
]);

The safe=1 and +iframe combination is a conflict: safe mode is designed to strip dangerous elements, but the elements override re-enables <iframe> without also blocking the dangerous srcdoc attribute.

Proof of Concept

Input to cleanupXss():

<iframe srcdoc="&lt;script&gt;alert(document.domain)&lt;/script&gt;"></iframe>

Output (unchanged — htmLawed passes it through):

<iframe srcdoc="&lt;script&gt;alert(document.domain)&lt;/script&gt;"></iframe>

When rendered via {{ content|raw }} in a template, srcdoc executes in an about:srcdoc frame with the same origin as the page. Confirmed via Puppeteer/Chromium headless: alert(document.domain) fires.

Validated on Wallabag (which uses Graby) via Docker: entry created via API with iframe-only content body triggers Readability failure → falls through to cleanupXss() path.

Impact

Stored XSS in any application rendering Graby-sanitized content via |raw
In Wallabag: affects both authenticated views and public share pages (unauthenticated)
No CSP headers in default Wallabag config — no secondary mitigation

Suggested Fix

Either remove +iframe from the elements config to keep iframes blocked:

'elements' => '*-iframe-meta',

Or explicitly deny the srcdoc attribute:

'deny_attribute' => 'style srcdoc',

Credit

Discovered by @tikket1, 2026-03-25. Redirected from wallabag/wallabag advisory by @j0k3r.

Affected versions


          1.0.0


          1.0.0-alpha.0


          1.0.0-alpha.1


          1.0.0-alpha.2


          1.0.1


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.0.6


          1.0.7


          1.0.8

+ 82 more


            1.1.0


            1.10.0


            1.10.1


            1.11.0


            1.11.1


            1.12.0


            1.12.1


            1.13.0


            1.13.1


            1.13.2


            1.13.3


            1.13.4


            1.13.5


            1.13.6


            1.14.0


            1.15.0


            1.15.1


            1.15.2


            1.15.3


            1.15.4


            1.15.5


            1.16.0


            1.17.0


            1.18.0


            1.18.1


            1.19.0


            1.19.1


            1.2.0


            1.20.0


            1.20.1


            1.3.0


            1.4.0


            1.4.1


            1.4.2


            1.4.3


            1.4.4


            1.4.5


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.4


            1.6.0


            1.6.1


            1.6.2


            1.7.0


            1.7.1


            1.8.0


            1.8.1


            1.8.2


            1.9.0


            1.9.1


            1.9.2


            1.9.3


            2.0.0


            2.0.0-alpha.0


            2.0.1


            2.0.2


            2.1.0


            2.1.1


            2.2.0


            2.2.1


            2.2.4


            2.2.5


            2.2.6


            2.2.7


            2.3.0


            2.3.1


            2.3.2


            2.3.3


            2.3.4


            2.3.5


            2.4.0


            2.4.1


            2.4.2


            2.4.3


            2.4.4


            2.4.5


            2.4.6


            v2.2.2


            v2.2.3


            v2.5.0

Fixed in


          2.5.1

References

Updated Mar 31, 2026 · Source: OSV.dev

Jan 07, 2022

2.3.4 patch

1 CVE

GHSA-3h6j-9x8m-rg3g Mar 31, 2026

Graby has stored XSS via iframe srcdoc Attribute in htmLawed Sanitization Config

Low

Network Low None

Summary

Graby's cleanupXss() function configures htmLawed with conflicting settings: safe=1 (which removes <iframe>) combined with 'elements' => '*+iframe-meta' (which re-enables <iframe>). htmLawed does not sanitize the srcdoc attribute, allowing injection of arbitrary JavaScript that executes when the content is rendered via |raw in templates.

Root Cause

src/Graby.php lines 1038-1048:

htmLawed($html, [
    'safe' => 1,                    // removes <iframe>
    'elements' => '*+iframe-meta',  // re-adds <iframe>, overrides safe=1
    'deny_attribute' => 'style',    // srcdoc is NOT denied
]);

The safe=1 and +iframe combination is a conflict: safe mode is designed to strip dangerous elements, but the elements override re-enables <iframe> without also blocking the dangerous srcdoc attribute.

Proof of Concept

Input to cleanupXss():

<iframe srcdoc="&lt;script&gt;alert(document.domain)&lt;/script&gt;"></iframe>

Output (unchanged — htmLawed passes it through):

<iframe srcdoc="&lt;script&gt;alert(document.domain)&lt;/script&gt;"></iframe>

When rendered via {{ content|raw }} in a template, srcdoc executes in an about:srcdoc frame with the same origin as the page. Confirmed via Puppeteer/Chromium headless: alert(document.domain) fires.

Validated on Wallabag (which uses Graby) via Docker: entry created via API with iframe-only content body triggers Readability failure → falls through to cleanupXss() path.

Impact

Stored XSS in any application rendering Graby-sanitized content via |raw
In Wallabag: affects both authenticated views and public share pages (unauthenticated)
No CSP headers in default Wallabag config — no secondary mitigation

Suggested Fix

Either remove +iframe from the elements config to keep iframes blocked:

'elements' => '*-iframe-meta',

Or explicitly deny the srcdoc attribute:

'deny_attribute' => 'style srcdoc',

Credit

Discovered by @tikket1, 2026-03-25. Redirected from wallabag/wallabag advisory by @j0k3r.

Affected versions


          1.0.0


          1.0.0-alpha.0


          1.0.0-alpha.1


          1.0.0-alpha.2


          1.0.1


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.0.6


          1.0.7


          1.0.8

+ 82 more


            1.1.0


            1.10.0


            1.10.1


            1.11.0


            1.11.1


            1.12.0


            1.12.1


            1.13.0


            1.13.1


            1.13.2


            1.13.3


            1.13.4


            1.13.5


            1.13.6


            1.14.0


            1.15.0


            1.15.1


            1.15.2


            1.15.3


            1.15.4


            1.15.5


            1.16.0


            1.17.0


            1.18.0


            1.18.1


            1.19.0


            1.19.1


            1.2.0


            1.20.0


            1.20.1


            1.3.0


            1.4.0


            1.4.1


            1.4.2


            1.4.3


            1.4.4


            1.4.5


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.4


            1.6.0


            1.6.1


            1.6.2


            1.7.0


            1.7.1


            1.8.0


            1.8.1


            1.8.2


            1.9.0


            1.9.1


            1.9.2


            1.9.3


            2.0.0


            2.0.0-alpha.0


            2.0.1


            2.0.2


            2.1.0


            2.1.1


            2.2.0


            2.2.1


            2.2.4


            2.2.5


            2.2.6


            2.2.7


            2.3.0


            2.3.1


            2.3.2


            2.3.3


            2.3.4


            2.3.5


            2.4.0


            2.4.1


            2.4.2


            2.4.3


            2.4.4


            2.4.5


            2.4.6


            v2.2.2


            v2.2.3


            v2.5.0

Fixed in


          2.5.1

References

Updated Mar 31, 2026 · Source: OSV.dev

Jan 07, 2022

2.3.3 patch

1 CVE

GHSA-3h6j-9x8m-rg3g Mar 31, 2026

Graby has stored XSS via iframe srcdoc Attribute in htmLawed Sanitization Config

Low

Network Low None

Summary

Graby's cleanupXss() function configures htmLawed with conflicting settings: safe=1 (which removes <iframe>) combined with 'elements' => '*+iframe-meta' (which re-enables <iframe>). htmLawed does not sanitize the srcdoc attribute, allowing injection of arbitrary JavaScript that executes when the content is rendered via |raw in templates.

Root Cause

src/Graby.php lines 1038-1048:

htmLawed($html, [
    'safe' => 1,                    // removes <iframe>
    'elements' => '*+iframe-meta',  // re-adds <iframe>, overrides safe=1
    'deny_attribute' => 'style',    // srcdoc is NOT denied
]);

The safe=1 and +iframe combination is a conflict: safe mode is designed to strip dangerous elements, but the elements override re-enables <iframe> without also blocking the dangerous srcdoc attribute.

Proof of Concept

Input to cleanupXss():

<iframe srcdoc="&lt;script&gt;alert(document.domain)&lt;/script&gt;"></iframe>

Output (unchanged — htmLawed passes it through):

<iframe srcdoc="&lt;script&gt;alert(document.domain)&lt;/script&gt;"></iframe>

When rendered via {{ content|raw }} in a template, srcdoc executes in an about:srcdoc frame with the same origin as the page. Confirmed via Puppeteer/Chromium headless: alert(document.domain) fires.

Validated on Wallabag (which uses Graby) via Docker: entry created via API with iframe-only content body triggers Readability failure → falls through to cleanupXss() path.

Impact

Stored XSS in any application rendering Graby-sanitized content via |raw
In Wallabag: affects both authenticated views and public share pages (unauthenticated)
No CSP headers in default Wallabag config — no secondary mitigation

Suggested Fix

Either remove +iframe from the elements config to keep iframes blocked:

'elements' => '*-iframe-meta',

Or explicitly deny the srcdoc attribute:

'deny_attribute' => 'style srcdoc',

Credit

Discovered by @tikket1, 2026-03-25. Redirected from wallabag/wallabag advisory by @j0k3r.

Affected versions


          1.0.0


          1.0.0-alpha.0


          1.0.0-alpha.1


          1.0.0-alpha.2


          1.0.1


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.0.6


          1.0.7


          1.0.8

+ 82 more


            1.1.0


            1.10.0


            1.10.1


            1.11.0


            1.11.1


            1.12.0


            1.12.1


            1.13.0


            1.13.1


            1.13.2


            1.13.3


            1.13.4


            1.13.5


            1.13.6


            1.14.0


            1.15.0


            1.15.1


            1.15.2


            1.15.3


            1.15.4


            1.15.5


            1.16.0


            1.17.0


            1.18.0


            1.18.1


            1.19.0


            1.19.1


            1.2.0


            1.20.0


            1.20.1


            1.3.0


            1.4.0


            1.4.1


            1.4.2


            1.4.3


            1.4.4


            1.4.5


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.4


            1.6.0


            1.6.1


            1.6.2


            1.7.0


            1.7.1


            1.8.0


            1.8.1


            1.8.2


            1.9.0


            1.9.1


            1.9.2


            1.9.3


            2.0.0


            2.0.0-alpha.0


            2.0.1


            2.0.2


            2.1.0


            2.1.1


            2.2.0


            2.2.1


            2.2.4


            2.2.5


            2.2.6


            2.2.7


            2.3.0


            2.3.1


            2.3.2


            2.3.3


            2.3.4


            2.3.5


            2.4.0


            2.4.1


            2.4.2


            2.4.3


            2.4.4


            2.4.5


            2.4.6


            v2.2.2


            v2.2.3


            v2.5.0

Fixed in


          2.5.1

References

Updated Mar 31, 2026 · Source: OSV.dev

Dec 13, 2021

2.3.2 patch

1 CVE

GHSA-3h6j-9x8m-rg3g Mar 31, 2026

Graby has stored XSS via iframe srcdoc Attribute in htmLawed Sanitization Config

Low

Network Low None

Summary

Graby's cleanupXss() function configures htmLawed with conflicting settings: safe=1 (which removes <iframe>) combined with 'elements' => '*+iframe-meta' (which re-enables <iframe>). htmLawed does not sanitize the srcdoc attribute, allowing injection of arbitrary JavaScript that executes when the content is rendered via |raw in templates.

Root Cause

src/Graby.php lines 1038-1048:

htmLawed($html, [
    'safe' => 1,                    // removes <iframe>
    'elements' => '*+iframe-meta',  // re-adds <iframe>, overrides safe=1
    'deny_attribute' => 'style',    // srcdoc is NOT denied
]);

The safe=1 and +iframe combination is a conflict: safe mode is designed to strip dangerous elements, but the elements override re-enables <iframe> without also blocking the dangerous srcdoc attribute.

Proof of Concept

Input to cleanupXss():

<iframe srcdoc="&lt;script&gt;alert(document.domain)&lt;/script&gt;"></iframe>

Output (unchanged — htmLawed passes it through):

<iframe srcdoc="&lt;script&gt;alert(document.domain)&lt;/script&gt;"></iframe>

When rendered via {{ content|raw }} in a template, srcdoc executes in an about:srcdoc frame with the same origin as the page. Confirmed via Puppeteer/Chromium headless: alert(document.domain) fires.

Validated on Wallabag (which uses Graby) via Docker: entry created via API with iframe-only content body triggers Readability failure → falls through to cleanupXss() path.

Impact

Stored XSS in any application rendering Graby-sanitized content via |raw
In Wallabag: affects both authenticated views and public share pages (unauthenticated)
No CSP headers in default Wallabag config — no secondary mitigation

Suggested Fix

Either remove +iframe from the elements config to keep iframes blocked:

'elements' => '*-iframe-meta',

Or explicitly deny the srcdoc attribute:

'deny_attribute' => 'style srcdoc',

Credit

Discovered by @tikket1, 2026-03-25. Redirected from wallabag/wallabag advisory by @j0k3r.

Affected versions


          1.0.0


          1.0.0-alpha.0


          1.0.0-alpha.1


          1.0.0-alpha.2


          1.0.1


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.0.6


          1.0.7


          1.0.8

+ 82 more


            1.1.0


            1.10.0


            1.10.1


            1.11.0


            1.11.1


            1.12.0


            1.12.1


            1.13.0


            1.13.1


            1.13.2


            1.13.3


            1.13.4


            1.13.5


            1.13.6


            1.14.0


            1.15.0


            1.15.1


            1.15.2


            1.15.3


            1.15.4


            1.15.5


            1.16.0


            1.17.0


            1.18.0


            1.18.1


            1.19.0


            1.19.1


            1.2.0


            1.20.0


            1.20.1


            1.3.0


            1.4.0


            1.4.1


            1.4.2


            1.4.3


            1.4.4


            1.4.5


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.4


            1.6.0


            1.6.1


            1.6.2


            1.7.0


            1.7.1


            1.8.0


            1.8.1


            1.8.2


            1.9.0


            1.9.1


            1.9.2


            1.9.3


            2.0.0


            2.0.0-alpha.0


            2.0.1


            2.0.2


            2.1.0


            2.1.1


            2.2.0


            2.2.1


            2.2.4


            2.2.5


            2.2.6


            2.2.7


            2.3.0


            2.3.1


            2.3.2


            2.3.3


            2.3.4


            2.3.5


            2.4.0


            2.4.1


            2.4.2


            2.4.3


            2.4.4


            2.4.5


            2.4.6


            v2.2.2


            v2.2.3


            v2.5.0

Fixed in


          2.5.1

References

Updated Mar 31, 2026 · Source: OSV.dev

Oct 29, 2021

2.3.1 patch

1 CVE

GHSA-3h6j-9x8m-rg3g Mar 31, 2026

Graby has stored XSS via iframe srcdoc Attribute in htmLawed Sanitization Config

Low

Network Low None

Summary

Graby's cleanupXss() function configures htmLawed with conflicting settings: safe=1 (which removes <iframe>) combined with 'elements' => '*+iframe-meta' (which re-enables <iframe>). htmLawed does not sanitize the srcdoc attribute, allowing injection of arbitrary JavaScript that executes when the content is rendered via |raw in templates.

Root Cause

src/Graby.php lines 1038-1048:

htmLawed($html, [
    'safe' => 1,                    // removes <iframe>
    'elements' => '*+iframe-meta',  // re-adds <iframe>, overrides safe=1
    'deny_attribute' => 'style',    // srcdoc is NOT denied
]);

The safe=1 and +iframe combination is a conflict: safe mode is designed to strip dangerous elements, but the elements override re-enables <iframe> without also blocking the dangerous srcdoc attribute.

Proof of Concept

Input to cleanupXss():

<iframe srcdoc="&lt;script&gt;alert(document.domain)&lt;/script&gt;"></iframe>

Output (unchanged — htmLawed passes it through):

<iframe srcdoc="&lt;script&gt;alert(document.domain)&lt;/script&gt;"></iframe>

When rendered via {{ content|raw }} in a template, srcdoc executes in an about:srcdoc frame with the same origin as the page. Confirmed via Puppeteer/Chromium headless: alert(document.domain) fires.

Validated on Wallabag (which uses Graby) via Docker: entry created via API with iframe-only content body triggers Readability failure → falls through to cleanupXss() path.

Impact

Stored XSS in any application rendering Graby-sanitized content via |raw
In Wallabag: affects both authenticated views and public share pages (unauthenticated)
No CSP headers in default Wallabag config — no secondary mitigation

Suggested Fix

Either remove +iframe from the elements config to keep iframes blocked:

'elements' => '*-iframe-meta',

Or explicitly deny the srcdoc attribute:

'deny_attribute' => 'style srcdoc',

Credit

Discovered by @tikket1, 2026-03-25. Redirected from wallabag/wallabag advisory by @j0k3r.

Affected versions


          1.0.0


          1.0.0-alpha.0


          1.0.0-alpha.1


          1.0.0-alpha.2


          1.0.1


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.0.6


          1.0.7


          1.0.8

+ 82 more


            1.1.0


            1.10.0


            1.10.1


            1.11.0


            1.11.1


            1.12.0


            1.12.1


            1.13.0


            1.13.1


            1.13.2


            1.13.3


            1.13.4


            1.13.5


            1.13.6


            1.14.0


            1.15.0


            1.15.1


            1.15.2


            1.15.3


            1.15.4


            1.15.5


            1.16.0


            1.17.0


            1.18.0


            1.18.1


            1.19.0


            1.19.1


            1.2.0


            1.20.0


            1.20.1


            1.3.0


            1.4.0


            1.4.1


            1.4.2


            1.4.3


            1.4.4


            1.4.5


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.4


            1.6.0


            1.6.1


            1.6.2


            1.7.0


            1.7.1


            1.8.0


            1.8.1


            1.8.2


            1.9.0


            1.9.1


            1.9.2


            1.9.3


            2.0.0


            2.0.0-alpha.0


            2.0.1


            2.0.2


            2.1.0


            2.1.1


            2.2.0


            2.2.1


            2.2.4


            2.2.5


            2.2.6


            2.2.7


            2.3.0


            2.3.1


            2.3.2


            2.3.3


            2.3.4


            2.3.5


            2.4.0


            2.4.1


            2.4.2


            2.4.3


            2.4.4


            2.4.5


            2.4.6


            v2.2.2


            v2.2.3


            v2.5.0

Fixed in


          2.5.1

References

Updated Mar 31, 2026 · Source: OSV.dev

Oct 05, 2021

2.3.0 minor

1 CVE

GHSA-3h6j-9x8m-rg3g Mar 31, 2026

Graby has stored XSS via iframe srcdoc Attribute in htmLawed Sanitization Config

Low

Network Low None

Summary

Graby's cleanupXss() function configures htmLawed with conflicting settings: safe=1 (which removes <iframe>) combined with 'elements' => '*+iframe-meta' (which re-enables <iframe>). htmLawed does not sanitize the srcdoc attribute, allowing injection of arbitrary JavaScript that executes when the content is rendered via |raw in templates.

Root Cause

src/Graby.php lines 1038-1048:

htmLawed($html, [
    'safe' => 1,                    // removes <iframe>
    'elements' => '*+iframe-meta',  // re-adds <iframe>, overrides safe=1
    'deny_attribute' => 'style',    // srcdoc is NOT denied
]);

The safe=1 and +iframe combination is a conflict: safe mode is designed to strip dangerous elements, but the elements override re-enables <iframe> without also blocking the dangerous srcdoc attribute.

Proof of Concept

Input to cleanupXss():

<iframe srcdoc="&lt;script&gt;alert(document.domain)&lt;/script&gt;"></iframe>

Output (unchanged — htmLawed passes it through):

<iframe srcdoc="&lt;script&gt;alert(document.domain)&lt;/script&gt;"></iframe>

When rendered via {{ content|raw }} in a template, srcdoc executes in an about:srcdoc frame with the same origin as the page. Confirmed via Puppeteer/Chromium headless: alert(document.domain) fires.

Validated on Wallabag (which uses Graby) via Docker: entry created via API with iframe-only content body triggers Readability failure → falls through to cleanupXss() path.

Impact

Stored XSS in any application rendering Graby-sanitized content via |raw
In Wallabag: affects both authenticated views and public share pages (unauthenticated)
No CSP headers in default Wallabag config — no secondary mitigation

Suggested Fix

Either remove +iframe from the elements config to keep iframes blocked:

'elements' => '*-iframe-meta',

Or explicitly deny the srcdoc attribute:

'deny_attribute' => 'style srcdoc',

Credit

Discovered by @tikket1, 2026-03-25. Redirected from wallabag/wallabag advisory by @j0k3r.

Affected versions


          1.0.0


          1.0.0-alpha.0


          1.0.0-alpha.1


          1.0.0-alpha.2


          1.0.1


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.0.6


          1.0.7


          1.0.8

+ 82 more


            1.1.0


            1.10.0


            1.10.1


            1.11.0


            1.11.1


            1.12.0


            1.12.1


            1.13.0


            1.13.1


            1.13.2


            1.13.3


            1.13.4


            1.13.5


            1.13.6


            1.14.0


            1.15.0


            1.15.1


            1.15.2


            1.15.3


            1.15.4


            1.15.5


            1.16.0


            1.17.0


            1.18.0


            1.18.1


            1.19.0


            1.19.1


            1.2.0


            1.20.0


            1.20.1


            1.3.0


            1.4.0


            1.4.1


            1.4.2


            1.4.3


            1.4.4


            1.4.5


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.4


            1.6.0


            1.6.1


            1.6.2


            1.7.0


            1.7.1


            1.8.0


            1.8.1


            1.8.2


            1.9.0


            1.9.1


            1.9.2


            1.9.3


            2.0.0


            2.0.0-alpha.0


            2.0.1


            2.0.2


            2.1.0


            2.1.1


            2.2.0


            2.2.1


            2.2.4


            2.2.5


            2.2.6


            2.2.7


            2.3.0


            2.3.1


            2.3.2


            2.3.3


            2.3.4


            2.3.5


            2.4.0


            2.4.1


            2.4.2


            2.4.3


            2.4.4


            2.4.5


            2.4.6


            v2.2.2


            v2.2.3


            v2.5.0

Fixed in


          2.5.1

References

Updated Mar 31, 2026 · Source: OSV.dev

Jun 01, 2021

2.2.7 patch

1 CVE

GHSA-3h6j-9x8m-rg3g Mar 31, 2026

Graby has stored XSS via iframe srcdoc Attribute in htmLawed Sanitization Config

Low

Network Low None

Summary

Graby's cleanupXss() function configures htmLawed with conflicting settings: safe=1 (which removes <iframe>) combined with 'elements' => '*+iframe-meta' (which re-enables <iframe>). htmLawed does not sanitize the srcdoc attribute, allowing injection of arbitrary JavaScript that executes when the content is rendered via |raw in templates.

Root Cause

src/Graby.php lines 1038-1048:

htmLawed($html, [
    'safe' => 1,                    // removes <iframe>
    'elements' => '*+iframe-meta',  // re-adds <iframe>, overrides safe=1
    'deny_attribute' => 'style',    // srcdoc is NOT denied
]);

The safe=1 and +iframe combination is a conflict: safe mode is designed to strip dangerous elements, but the elements override re-enables <iframe> without also blocking the dangerous srcdoc attribute.

Proof of Concept

Input to cleanupXss():

<iframe srcdoc="&lt;script&gt;alert(document.domain)&lt;/script&gt;"></iframe>

Output (unchanged — htmLawed passes it through):

<iframe srcdoc="&lt;script&gt;alert(document.domain)&lt;/script&gt;"></iframe>

When rendered via {{ content|raw }} in a template, srcdoc executes in an about:srcdoc frame with the same origin as the page. Confirmed via Puppeteer/Chromium headless: alert(document.domain) fires.

Validated on Wallabag (which uses Graby) via Docker: entry created via API with iframe-only content body triggers Readability failure → falls through to cleanupXss() path.

Impact

Stored XSS in any application rendering Graby-sanitized content via |raw
In Wallabag: affects both authenticated views and public share pages (unauthenticated)
No CSP headers in default Wallabag config — no secondary mitigation

Suggested Fix

Either remove +iframe from the elements config to keep iframes blocked:

'elements' => '*-iframe-meta',

Or explicitly deny the srcdoc attribute:

'deny_attribute' => 'style srcdoc',

Credit

Discovered by @tikket1, 2026-03-25. Redirected from wallabag/wallabag advisory by @j0k3r.

Affected versions


          1.0.0


          1.0.0-alpha.0


          1.0.0-alpha.1


          1.0.0-alpha.2


          1.0.1


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.0.6


          1.0.7


          1.0.8

+ 82 more


            1.1.0


            1.10.0


            1.10.1


            1.11.0


            1.11.1


            1.12.0


            1.12.1


            1.13.0


            1.13.1


            1.13.2


            1.13.3


            1.13.4


            1.13.5


            1.13.6


            1.14.0


            1.15.0


            1.15.1


            1.15.2


            1.15.3


            1.15.4


            1.15.5


            1.16.0


            1.17.0


            1.18.0


            1.18.1


            1.19.0


            1.19.1


            1.2.0


            1.20.0


            1.20.1


            1.3.0


            1.4.0


            1.4.1


            1.4.2


            1.4.3


            1.4.4


            1.4.5


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.4


            1.6.0


            1.6.1


            1.6.2


            1.7.0


            1.7.1


            1.8.0


            1.8.1


            1.8.2


            1.9.0


            1.9.1


            1.9.2


            1.9.3


            2.0.0


            2.0.0-alpha.0


            2.0.1


            2.0.2


            2.1.0


            2.1.1


            2.2.0


            2.2.1


            2.2.4


            2.2.5


            2.2.6


            2.2.7


            2.3.0


            2.3.1


            2.3.2


            2.3.3


            2.3.4


            2.3.5


            2.4.0


            2.4.1


            2.4.2


            2.4.3


            2.4.4


            2.4.5


            2.4.6


            v2.2.2


            v2.2.3


            v2.5.0

Fixed in


          2.5.1

References

Updated Mar 31, 2026 · Source: OSV.dev

Apr 28, 2021

2.2.6 patch

1 CVE

GHSA-3h6j-9x8m-rg3g Mar 31, 2026

Graby has stored XSS via iframe srcdoc Attribute in htmLawed Sanitization Config

Low

Network Low None

Summary

Graby's cleanupXss() function configures htmLawed with conflicting settings: safe=1 (which removes <iframe>) combined with 'elements' => '*+iframe-meta' (which re-enables <iframe>). htmLawed does not sanitize the srcdoc attribute, allowing injection of arbitrary JavaScript that executes when the content is rendered via |raw in templates.

Root Cause

src/Graby.php lines 1038-1048:

htmLawed($html, [
    'safe' => 1,                    // removes <iframe>
    'elements' => '*+iframe-meta',  // re-adds <iframe>, overrides safe=1
    'deny_attribute' => 'style',    // srcdoc is NOT denied
]);

The safe=1 and +iframe combination is a conflict: safe mode is designed to strip dangerous elements, but the elements override re-enables <iframe> without also blocking the dangerous srcdoc attribute.

Proof of Concept

Input to cleanupXss():

<iframe srcdoc="&lt;script&gt;alert(document.domain)&lt;/script&gt;"></iframe>

Output (unchanged — htmLawed passes it through):

<iframe srcdoc="&lt;script&gt;alert(document.domain)&lt;/script&gt;"></iframe>

When rendered via {{ content|raw }} in a template, srcdoc executes in an about:srcdoc frame with the same origin as the page. Confirmed via Puppeteer/Chromium headless: alert(document.domain) fires.

Validated on Wallabag (which uses Graby) via Docker: entry created via API with iframe-only content body triggers Readability failure → falls through to cleanupXss() path.

Impact

Stored XSS in any application rendering Graby-sanitized content via |raw
In Wallabag: affects both authenticated views and public share pages (unauthenticated)
No CSP headers in default Wallabag config — no secondary mitigation

Suggested Fix

Either remove +iframe from the elements config to keep iframes blocked:

'elements' => '*-iframe-meta',

Or explicitly deny the srcdoc attribute:

'deny_attribute' => 'style srcdoc',

Credit

Discovered by @tikket1, 2026-03-25. Redirected from wallabag/wallabag advisory by @j0k3r.

Affected versions


          1.0.0


          1.0.0-alpha.0


          1.0.0-alpha.1


          1.0.0-alpha.2


          1.0.1


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.0.6


          1.0.7


          1.0.8

+ 82 more


            1.1.0


            1.10.0


            1.10.1


            1.11.0


            1.11.1


            1.12.0


            1.12.1


            1.13.0


            1.13.1


            1.13.2


            1.13.3


            1.13.4


            1.13.5


            1.13.6


            1.14.0


            1.15.0


            1.15.1


            1.15.2


            1.15.3


            1.15.4


            1.15.5


            1.16.0


            1.17.0


            1.18.0


            1.18.1


            1.19.0


            1.19.1


            1.2.0


            1.20.0


            1.20.1


            1.3.0


            1.4.0


            1.4.1


            1.4.2


            1.4.3


            1.4.4


            1.4.5


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.4


            1.6.0


            1.6.1


            1.6.2


            1.7.0


            1.7.1


            1.8.0


            1.8.1


            1.8.2


            1.9.0


            1.9.1


            1.9.2


            1.9.3


            2.0.0


            2.0.0-alpha.0


            2.0.1


            2.0.2


            2.1.0


            2.1.1


            2.2.0


            2.2.1


            2.2.4


            2.2.5


            2.2.6


            2.2.7


            2.3.0


            2.3.1


            2.3.2


            2.3.3


            2.3.4


            2.3.5


            2.4.0


            2.4.1


            2.4.2


            2.4.3


            2.4.4


            2.4.5


            2.4.6


            v2.2.2


            v2.2.3


            v2.5.0

Fixed in


          2.5.1

References

Updated Mar 31, 2026 · Source: OSV.dev

Apr 14, 2021

2.2.5 patch

1 CVE

GHSA-3h6j-9x8m-rg3g Mar 31, 2026

Graby has stored XSS via iframe srcdoc Attribute in htmLawed Sanitization Config

Low

Network Low None

Summary

Graby's cleanupXss() function configures htmLawed with conflicting settings: safe=1 (which removes <iframe>) combined with 'elements' => '*+iframe-meta' (which re-enables <iframe>). htmLawed does not sanitize the srcdoc attribute, allowing injection of arbitrary JavaScript that executes when the content is rendered via |raw in templates.

Root Cause

src/Graby.php lines 1038-1048:

htmLawed($html, [
    'safe' => 1,                    // removes <iframe>
    'elements' => '*+iframe-meta',  // re-adds <iframe>, overrides safe=1
    'deny_attribute' => 'style',    // srcdoc is NOT denied
]);

The safe=1 and +iframe combination is a conflict: safe mode is designed to strip dangerous elements, but the elements override re-enables <iframe> without also blocking the dangerous srcdoc attribute.

Proof of Concept

Input to cleanupXss():

<iframe srcdoc="&lt;script&gt;alert(document.domain)&lt;/script&gt;"></iframe>

Output (unchanged — htmLawed passes it through):

<iframe srcdoc="&lt;script&gt;alert(document.domain)&lt;/script&gt;"></iframe>

When rendered via {{ content|raw }} in a template, srcdoc executes in an about:srcdoc frame with the same origin as the page. Confirmed via Puppeteer/Chromium headless: alert(document.domain) fires.

Validated on Wallabag (which uses Graby) via Docker: entry created via API with iframe-only content body triggers Readability failure → falls through to cleanupXss() path.

Impact

Stored XSS in any application rendering Graby-sanitized content via |raw
In Wallabag: affects both authenticated views and public share pages (unauthenticated)
No CSP headers in default Wallabag config — no secondary mitigation

Suggested Fix

Either remove +iframe from the elements config to keep iframes blocked:

'elements' => '*-iframe-meta',

Or explicitly deny the srcdoc attribute:

'deny_attribute' => 'style srcdoc',

Credit

Discovered by @tikket1, 2026-03-25. Redirected from wallabag/wallabag advisory by @j0k3r.

Affected versions


          1.0.0


          1.0.0-alpha.0


          1.0.0-alpha.1


          1.0.0-alpha.2


          1.0.1


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.0.6


          1.0.7


          1.0.8

+ 82 more


            1.1.0


            1.10.0


            1.10.1


            1.11.0


            1.11.1


            1.12.0


            1.12.1


            1.13.0


            1.13.1


            1.13.2


            1.13.3


            1.13.4


            1.13.5


            1.13.6


            1.14.0


            1.15.0


            1.15.1


            1.15.2


            1.15.3


            1.15.4


            1.15.5


            1.16.0


            1.17.0


            1.18.0


            1.18.1


            1.19.0


            1.19.1


            1.2.0


            1.20.0


            1.20.1


            1.3.0


            1.4.0


            1.4.1


            1.4.2


            1.4.3


            1.4.4


            1.4.5


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.4


            1.6.0


            1.6.1


            1.6.2


            1.7.0


            1.7.1


            1.8.0


            1.8.1


            1.8.2


            1.9.0


            1.9.1


            1.9.2


            1.9.3


            2.0.0


            2.0.0-alpha.0


            2.0.1


            2.0.2


            2.1.0


            2.1.1


            2.2.0


            2.2.1


            2.2.4


            2.2.5


            2.2.6


            2.2.7


            2.3.0


            2.3.1


            2.3.2


            2.3.3


            2.3.4


            2.3.5


            2.4.0


            2.4.1


            2.4.2


            2.4.3


            2.4.4


            2.4.5


            2.4.6


            v2.2.2


            v2.2.3


            v2.5.0

Fixed in


          2.5.1

References

Updated Mar 31, 2026 · Source: OSV.dev

Jan 20, 2021

2.2.4 patch

1 CVE

GHSA-3h6j-9x8m-rg3g Mar 31, 2026

Graby has stored XSS via iframe srcdoc Attribute in htmLawed Sanitization Config

Low

Network Low None

Summary

Graby's cleanupXss() function configures htmLawed with conflicting settings: safe=1 (which removes <iframe>) combined with 'elements' => '*+iframe-meta' (which re-enables <iframe>). htmLawed does not sanitize the srcdoc attribute, allowing injection of arbitrary JavaScript that executes when the content is rendered via |raw in templates.

Root Cause

src/Graby.php lines 1038-1048:

htmLawed($html, [
    'safe' => 1,                    // removes <iframe>
    'elements' => '*+iframe-meta',  // re-adds <iframe>, overrides safe=1
    'deny_attribute' => 'style',    // srcdoc is NOT denied
]);

The safe=1 and +iframe combination is a conflict: safe mode is designed to strip dangerous elements, but the elements override re-enables <iframe> without also blocking the dangerous srcdoc attribute.

Proof of Concept

Input to cleanupXss():

<iframe srcdoc="&lt;script&gt;alert(document.domain)&lt;/script&gt;"></iframe>

Output (unchanged — htmLawed passes it through):

<iframe srcdoc="&lt;script&gt;alert(document.domain)&lt;/script&gt;"></iframe>

When rendered via {{ content|raw }} in a template, srcdoc executes in an about:srcdoc frame with the same origin as the page. Confirmed via Puppeteer/Chromium headless: alert(document.domain) fires.

Validated on Wallabag (which uses Graby) via Docker: entry created via API with iframe-only content body triggers Readability failure → falls through to cleanupXss() path.

Impact

Stored XSS in any application rendering Graby-sanitized content via |raw
In Wallabag: affects both authenticated views and public share pages (unauthenticated)
No CSP headers in default Wallabag config — no secondary mitigation

Suggested Fix

Either remove +iframe from the elements config to keep iframes blocked:

'elements' => '*-iframe-meta',

Or explicitly deny the srcdoc attribute:

'deny_attribute' => 'style srcdoc',

Credit

Discovered by @tikket1, 2026-03-25. Redirected from wallabag/wallabag advisory by @j0k3r.

Affected versions


          1.0.0


          1.0.0-alpha.0


          1.0.0-alpha.1


          1.0.0-alpha.2


          1.0.1


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.0.6


          1.0.7


          1.0.8

+ 82 more


            1.1.0


            1.10.0


            1.10.1


            1.11.0


            1.11.1


            1.12.0


            1.12.1


            1.13.0


            1.13.1


            1.13.2


            1.13.3


            1.13.4


            1.13.5


            1.13.6


            1.14.0


            1.15.0


            1.15.1


            1.15.2


            1.15.3


            1.15.4


            1.15.5


            1.16.0


            1.17.0


            1.18.0


            1.18.1


            1.19.0


            1.19.1


            1.2.0


            1.20.0


            1.20.1


            1.3.0


            1.4.0


            1.4.1


            1.4.2


            1.4.3


            1.4.4


            1.4.5


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.4


            1.6.0


            1.6.1


            1.6.2


            1.7.0


            1.7.1


            1.8.0


            1.8.1


            1.8.2


            1.9.0


            1.9.1


            1.9.2


            1.9.3


            2.0.0


            2.0.0-alpha.0


            2.0.1


            2.0.2


            2.1.0


            2.1.1


            2.2.0


            2.2.1


            2.2.4


            2.2.5


            2.2.6


            2.2.7


            2.3.0


            2.3.1


            2.3.2


            2.3.3


            2.3.4


            2.3.5


            2.4.0


            2.4.1


            2.4.2


            2.4.3


            2.4.4


            2.4.5


            2.4.6


            v2.2.2


            v2.2.3


            v2.5.0

Fixed in


          2.5.1

References

Updated Mar 31, 2026 · Source: OSV.dev

Jan 04, 2021

v2.2.3 patch

1 CVE

GHSA-3h6j-9x8m-rg3g Mar 31, 2026

Graby has stored XSS via iframe srcdoc Attribute in htmLawed Sanitization Config

Low

Network Low None

Summary

Graby's cleanupXss() function configures htmLawed with conflicting settings: safe=1 (which removes <iframe>) combined with 'elements' => '*+iframe-meta' (which re-enables <iframe>). htmLawed does not sanitize the srcdoc attribute, allowing injection of arbitrary JavaScript that executes when the content is rendered via |raw in templates.

Root Cause

src/Graby.php lines 1038-1048:

htmLawed($html, [
    'safe' => 1,                    // removes <iframe>
    'elements' => '*+iframe-meta',  // re-adds <iframe>, overrides safe=1
    'deny_attribute' => 'style',    // srcdoc is NOT denied
]);

The safe=1 and +iframe combination is a conflict: safe mode is designed to strip dangerous elements, but the elements override re-enables <iframe> without also blocking the dangerous srcdoc attribute.

Proof of Concept

Input to cleanupXss():

<iframe srcdoc="&lt;script&gt;alert(document.domain)&lt;/script&gt;"></iframe>

Output (unchanged — htmLawed passes it through):

<iframe srcdoc="&lt;script&gt;alert(document.domain)&lt;/script&gt;"></iframe>

When rendered via {{ content|raw }} in a template, srcdoc executes in an about:srcdoc frame with the same origin as the page. Confirmed via Puppeteer/Chromium headless: alert(document.domain) fires.

Validated on Wallabag (which uses Graby) via Docker: entry created via API with iframe-only content body triggers Readability failure → falls through to cleanupXss() path.

Impact

Stored XSS in any application rendering Graby-sanitized content via |raw
In Wallabag: affects both authenticated views and public share pages (unauthenticated)
No CSP headers in default Wallabag config — no secondary mitigation

Suggested Fix

Either remove +iframe from the elements config to keep iframes blocked:

'elements' => '*-iframe-meta',

Or explicitly deny the srcdoc attribute:

'deny_attribute' => 'style srcdoc',

Credit

Discovered by @tikket1, 2026-03-25. Redirected from wallabag/wallabag advisory by @j0k3r.

Affected versions


          1.0.0


          1.0.0-alpha.0


          1.0.0-alpha.1


          1.0.0-alpha.2


          1.0.1


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.0.6


          1.0.7


          1.0.8

+ 82 more


            1.1.0


            1.10.0


            1.10.1


            1.11.0


            1.11.1


            1.12.0


            1.12.1


            1.13.0


            1.13.1


            1.13.2


            1.13.3


            1.13.4


            1.13.5


            1.13.6


            1.14.0


            1.15.0


            1.15.1


            1.15.2


            1.15.3


            1.15.4


            1.15.5


            1.16.0


            1.17.0


            1.18.0


            1.18.1


            1.19.0


            1.19.1


            1.2.0


            1.20.0


            1.20.1


            1.3.0


            1.4.0


            1.4.1


            1.4.2


            1.4.3


            1.4.4


            1.4.5


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.4


            1.6.0


            1.6.1


            1.6.2


            1.7.0


            1.7.1


            1.8.0


            1.8.1


            1.8.2


            1.9.0


            1.9.1


            1.9.2


            1.9.3


            2.0.0


            2.0.0-alpha.0


            2.0.1


            2.0.2


            2.1.0


            2.1.1


            2.2.0


            2.2.1


            2.2.4


            2.2.5


            2.2.6


            2.2.7


            2.3.0


            2.3.1


            2.3.2


            2.3.3


            2.3.4


            2.3.5


            2.4.0


            2.4.1


            2.4.2


            2.4.3


            2.4.4


            2.4.5


            2.4.6


            v2.2.2


            v2.2.3


            v2.5.0

Fixed in


          2.5.1

References

Updated Mar 31, 2026 · Source: OSV.dev

Nov 30, 2020

v2.2.2 patch

1 CVE

GHSA-3h6j-9x8m-rg3g Mar 31, 2026

Graby has stored XSS via iframe srcdoc Attribute in htmLawed Sanitization Config

Low

Network Low None

Summary

Graby's cleanupXss() function configures htmLawed with conflicting settings: safe=1 (which removes <iframe>) combined with 'elements' => '*+iframe-meta' (which re-enables <iframe>). htmLawed does not sanitize the srcdoc attribute, allowing injection of arbitrary JavaScript that executes when the content is rendered via |raw in templates.

Root Cause

src/Graby.php lines 1038-1048:

htmLawed($html, [
    'safe' => 1,                    // removes <iframe>
    'elements' => '*+iframe-meta',  // re-adds <iframe>, overrides safe=1
    'deny_attribute' => 'style',    // srcdoc is NOT denied
]);

The safe=1 and +iframe combination is a conflict: safe mode is designed to strip dangerous elements, but the elements override re-enables <iframe> without also blocking the dangerous srcdoc attribute.

Proof of Concept

Input to cleanupXss():

<iframe srcdoc="&lt;script&gt;alert(document.domain)&lt;/script&gt;"></iframe>

Output (unchanged — htmLawed passes it through):

<iframe srcdoc="&lt;script&gt;alert(document.domain)&lt;/script&gt;"></iframe>

When rendered via {{ content|raw }} in a template, srcdoc executes in an about:srcdoc frame with the same origin as the page. Confirmed via Puppeteer/Chromium headless: alert(document.domain) fires.

Validated on Wallabag (which uses Graby) via Docker: entry created via API with iframe-only content body triggers Readability failure → falls through to cleanupXss() path.

Impact

Stored XSS in any application rendering Graby-sanitized content via |raw
In Wallabag: affects both authenticated views and public share pages (unauthenticated)
No CSP headers in default Wallabag config — no secondary mitigation

Suggested Fix

Either remove +iframe from the elements config to keep iframes blocked:

'elements' => '*-iframe-meta',

Or explicitly deny the srcdoc attribute:

'deny_attribute' => 'style srcdoc',

Credit

Discovered by @tikket1, 2026-03-25. Redirected from wallabag/wallabag advisory by @j0k3r.

Affected versions


          1.0.0


          1.0.0-alpha.0


          1.0.0-alpha.1


          1.0.0-alpha.2


          1.0.1


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.0.6


          1.0.7


          1.0.8

+ 82 more


            1.1.0


            1.10.0


            1.10.1


            1.11.0


            1.11.1


            1.12.0


            1.12.1


            1.13.0


            1.13.1


            1.13.2


            1.13.3


            1.13.4


            1.13.5


            1.13.6


            1.14.0


            1.15.0


            1.15.1


            1.15.2


            1.15.3


            1.15.4


            1.15.5


            1.16.0


            1.17.0


            1.18.0


            1.18.1


            1.19.0


            1.19.1


            1.2.0


            1.20.0


            1.20.1


            1.3.0


            1.4.0


            1.4.1


            1.4.2


            1.4.3


            1.4.4


            1.4.5


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.4


            1.6.0


            1.6.1


            1.6.2


            1.7.0


            1.7.1


            1.8.0


            1.8.1


            1.8.2


            1.9.0


            1.9.1


            1.9.2


            1.9.3


            2.0.0


            2.0.0-alpha.0


            2.0.1


            2.0.2


            2.1.0


            2.1.1


            2.2.0


            2.2.1


            2.2.4


            2.2.5


            2.2.6


            2.2.7


            2.3.0


            2.3.1


            2.3.2


            2.3.3


            2.3.4


            2.3.5


            2.4.0


            2.4.1


            2.4.2


            2.4.3


            2.4.4


            2.4.5


            2.4.6


            v2.2.2


            v2.2.3


            v2.5.0

Fixed in


          2.5.1

References

Updated Mar 31, 2026 · Source: OSV.dev

Jun 25, 2020

2.2.1 patch

1 CVE

GHSA-3h6j-9x8m-rg3g Mar 31, 2026

Graby has stored XSS via iframe srcdoc Attribute in htmLawed Sanitization Config

Low

Network Low None

Summary

Graby's cleanupXss() function configures htmLawed with conflicting settings: safe=1 (which removes <iframe>) combined with 'elements' => '*+iframe-meta' (which re-enables <iframe>). htmLawed does not sanitize the srcdoc attribute, allowing injection of arbitrary JavaScript that executes when the content is rendered via |raw in templates.

Root Cause

src/Graby.php lines 1038-1048:

htmLawed($html, [
    'safe' => 1,                    // removes <iframe>
    'elements' => '*+iframe-meta',  // re-adds <iframe>, overrides safe=1
    'deny_attribute' => 'style',    // srcdoc is NOT denied
]);

The safe=1 and +iframe combination is a conflict: safe mode is designed to strip dangerous elements, but the elements override re-enables <iframe> without also blocking the dangerous srcdoc attribute.

Proof of Concept

Input to cleanupXss():

<iframe srcdoc="&lt;script&gt;alert(document.domain)&lt;/script&gt;"></iframe>

Output (unchanged — htmLawed passes it through):

<iframe srcdoc="&lt;script&gt;alert(document.domain)&lt;/script&gt;"></iframe>

When rendered via {{ content|raw }} in a template, srcdoc executes in an about:srcdoc frame with the same origin as the page. Confirmed via Puppeteer/Chromium headless: alert(document.domain) fires.

Validated on Wallabag (which uses Graby) via Docker: entry created via API with iframe-only content body triggers Readability failure → falls through to cleanupXss() path.

Impact

Stored XSS in any application rendering Graby-sanitized content via |raw
In Wallabag: affects both authenticated views and public share pages (unauthenticated)
No CSP headers in default Wallabag config — no secondary mitigation

Suggested Fix

Either remove +iframe from the elements config to keep iframes blocked:

'elements' => '*-iframe-meta',

Or explicitly deny the srcdoc attribute:

'deny_attribute' => 'style srcdoc',

Credit

Discovered by @tikket1, 2026-03-25. Redirected from wallabag/wallabag advisory by @j0k3r.

Affected versions


          1.0.0


          1.0.0-alpha.0


          1.0.0-alpha.1


          1.0.0-alpha.2


          1.0.1


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.0.6


          1.0.7


          1.0.8

+ 82 more


            1.1.0


            1.10.0


            1.10.1


            1.11.0


            1.11.1


            1.12.0


            1.12.1


            1.13.0


            1.13.1


            1.13.2


            1.13.3


            1.13.4


            1.13.5


            1.13.6


            1.14.0


            1.15.0


            1.15.1


            1.15.2


            1.15.3


            1.15.4


            1.15.5


            1.16.0


            1.17.0


            1.18.0


            1.18.1


            1.19.0


            1.19.1


            1.2.0


            1.20.0


            1.20.1


            1.3.0


            1.4.0


            1.4.1


            1.4.2


            1.4.3


            1.4.4


            1.4.5


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.4


            1.6.0


            1.6.1


            1.6.2


            1.7.0


            1.7.1


            1.8.0


            1.8.1


            1.8.2


            1.9.0


            1.9.1


            1.9.2


            1.9.3


            2.0.0


            2.0.0-alpha.0


            2.0.1


            2.0.2


            2.1.0


            2.1.1


            2.2.0


            2.2.1


            2.2.4


            2.2.5


            2.2.6


            2.2.7


            2.3.0


            2.3.1


            2.3.2


            2.3.3


            2.3.4


            2.3.5


            2.4.0


            2.4.1


            2.4.2


            2.4.3


            2.4.4


            2.4.5


            2.4.6


            v2.2.2


            v2.2.3


            v2.5.0

Fixed in


          2.5.1

References

Updated Mar 31, 2026 · Source: OSV.dev

Jun 02, 2020

2.2.0 minor

1 CVE

GHSA-3h6j-9x8m-rg3g Mar 31, 2026

Graby has stored XSS via iframe srcdoc Attribute in htmLawed Sanitization Config

Low

Network Low None

Summary

Graby's cleanupXss() function configures htmLawed with conflicting settings: safe=1 (which removes <iframe>) combined with 'elements' => '*+iframe-meta' (which re-enables <iframe>). htmLawed does not sanitize the srcdoc attribute, allowing injection of arbitrary JavaScript that executes when the content is rendered via |raw in templates.

Root Cause

src/Graby.php lines 1038-1048:

htmLawed($html, [
    'safe' => 1,                    // removes <iframe>
    'elements' => '*+iframe-meta',  // re-adds <iframe>, overrides safe=1
    'deny_attribute' => 'style',    // srcdoc is NOT denied
]);

The safe=1 and +iframe combination is a conflict: safe mode is designed to strip dangerous elements, but the elements override re-enables <iframe> without also blocking the dangerous srcdoc attribute.

Proof of Concept

Input to cleanupXss():

<iframe srcdoc="&lt;script&gt;alert(document.domain)&lt;/script&gt;"></iframe>

Output (unchanged — htmLawed passes it through):

<iframe srcdoc="&lt;script&gt;alert(document.domain)&lt;/script&gt;"></iframe>

When rendered via {{ content|raw }} in a template, srcdoc executes in an about:srcdoc frame with the same origin as the page. Confirmed via Puppeteer/Chromium headless: alert(document.domain) fires.

Validated on Wallabag (which uses Graby) via Docker: entry created via API with iframe-only content body triggers Readability failure → falls through to cleanupXss() path.

Impact

Stored XSS in any application rendering Graby-sanitized content via |raw
In Wallabag: affects both authenticated views and public share pages (unauthenticated)
No CSP headers in default Wallabag config — no secondary mitigation

Suggested Fix

Either remove +iframe from the elements config to keep iframes blocked:

'elements' => '*-iframe-meta',

Or explicitly deny the srcdoc attribute:

'deny_attribute' => 'style srcdoc',

Credit

Discovered by @tikket1, 2026-03-25. Redirected from wallabag/wallabag advisory by @j0k3r.

Affected versions


          1.0.0


          1.0.0-alpha.0


          1.0.0-alpha.1


          1.0.0-alpha.2


          1.0.1


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.0.6


          1.0.7


          1.0.8

+ 82 more


            1.1.0


            1.10.0


            1.10.1


            1.11.0


            1.11.1


            1.12.0


            1.12.1


            1.13.0


            1.13.1


            1.13.2


            1.13.3


            1.13.4


            1.13.5


            1.13.6


            1.14.0


            1.15.0


            1.15.1


            1.15.2


            1.15.3


            1.15.4


            1.15.5


            1.16.0


            1.17.0


            1.18.0


            1.18.1


            1.19.0


            1.19.1


            1.2.0


            1.20.0


            1.20.1


            1.3.0


            1.4.0


            1.4.1


            1.4.2


            1.4.3


            1.4.4


            1.4.5


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.4


            1.6.0


            1.6.1


            1.6.2


            1.7.0


            1.7.1


            1.8.0


            1.8.1


            1.8.2


            1.9.0


            1.9.1


            1.9.2


            1.9.3


            2.0.0


            2.0.0-alpha.0


            2.0.1


            2.0.2


            2.1.0


            2.1.1


            2.2.0


            2.2.1


            2.2.4


            2.2.5


            2.2.6


            2.2.7


            2.3.0


            2.3.1


            2.3.2


            2.3.3


            2.3.4


            2.3.5


            2.4.0


            2.4.1


            2.4.2


            2.4.3


            2.4.4


            2.4.5


            2.4.6


            v2.2.2


            v2.2.3


            v2.5.0

Fixed in


          2.5.1

References

Updated Mar 31, 2026 · Source: OSV.dev

Apr 15, 2020

2.1.1 patch

1 CVE

GHSA-3h6j-9x8m-rg3g Mar 31, 2026

Graby has stored XSS via iframe srcdoc Attribute in htmLawed Sanitization Config

Low

Network Low None

Summary

Graby's cleanupXss() function configures htmLawed with conflicting settings: safe=1 (which removes <iframe>) combined with 'elements' => '*+iframe-meta' (which re-enables <iframe>). htmLawed does not sanitize the srcdoc attribute, allowing injection of arbitrary JavaScript that executes when the content is rendered via |raw in templates.

Root Cause

src/Graby.php lines 1038-1048:

htmLawed($html, [
    'safe' => 1,                    // removes <iframe>
    'elements' => '*+iframe-meta',  // re-adds <iframe>, overrides safe=1
    'deny_attribute' => 'style',    // srcdoc is NOT denied
]);

The safe=1 and +iframe combination is a conflict: safe mode is designed to strip dangerous elements, but the elements override re-enables <iframe> without also blocking the dangerous srcdoc attribute.

Proof of Concept

Input to cleanupXss():

<iframe srcdoc="&lt;script&gt;alert(document.domain)&lt;/script&gt;"></iframe>

Output (unchanged — htmLawed passes it through):

<iframe srcdoc="&lt;script&gt;alert(document.domain)&lt;/script&gt;"></iframe>

When rendered via {{ content|raw }} in a template, srcdoc executes in an about:srcdoc frame with the same origin as the page. Confirmed via Puppeteer/Chromium headless: alert(document.domain) fires.

Validated on Wallabag (which uses Graby) via Docker: entry created via API with iframe-only content body triggers Readability failure → falls through to cleanupXss() path.

Impact

Stored XSS in any application rendering Graby-sanitized content via |raw
In Wallabag: affects both authenticated views and public share pages (unauthenticated)
No CSP headers in default Wallabag config — no secondary mitigation

Suggested Fix

Either remove +iframe from the elements config to keep iframes blocked:

'elements' => '*-iframe-meta',

Or explicitly deny the srcdoc attribute:

'deny_attribute' => 'style srcdoc',

Credit

Discovered by @tikket1, 2026-03-25. Redirected from wallabag/wallabag advisory by @j0k3r.

Affected versions


          1.0.0


          1.0.0-alpha.0


          1.0.0-alpha.1


          1.0.0-alpha.2


          1.0.1


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.0.6


          1.0.7


          1.0.8

+ 82 more


            1.1.0


            1.10.0


            1.10.1


            1.11.0


            1.11.1


            1.12.0


            1.12.1


            1.13.0


            1.13.1


            1.13.2


            1.13.3


            1.13.4


            1.13.5


            1.13.6


            1.14.0


            1.15.0


            1.15.1


            1.15.2


            1.15.3


            1.15.4


            1.15.5


            1.16.0


            1.17.0


            1.18.0


            1.18.1


            1.19.0


            1.19.1


            1.2.0


            1.20.0


            1.20.1


            1.3.0


            1.4.0


            1.4.1


            1.4.2


            1.4.3


            1.4.4


            1.4.5


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.4


            1.6.0


            1.6.1


            1.6.2


            1.7.0


            1.7.1


            1.8.0


            1.8.1


            1.8.2


            1.9.0


            1.9.1


            1.9.2


            1.9.3


            2.0.0


            2.0.0-alpha.0


            2.0.1


            2.0.2


            2.1.0


            2.1.1


            2.2.0


            2.2.1


            2.2.4


            2.2.5


            2.2.6


            2.2.7


            2.3.0


            2.3.1


            2.3.2


            2.3.3


            2.3.4


            2.3.5


            2.4.0


            2.4.1


            2.4.2


            2.4.3


            2.4.4


            2.4.5


            2.4.6


            v2.2.2


            v2.2.3


            v2.5.0

Fixed in


          2.5.1

References

Updated Mar 31, 2026 · Source: OSV.dev

Jan 23, 2020

2.1.0 minor

1 CVE

GHSA-3h6j-9x8m-rg3g Mar 31, 2026

Graby has stored XSS via iframe srcdoc Attribute in htmLawed Sanitization Config

Low

Network Low None

Summary

Graby's cleanupXss() function configures htmLawed with conflicting settings: safe=1 (which removes <iframe>) combined with 'elements' => '*+iframe-meta' (which re-enables <iframe>). htmLawed does not sanitize the srcdoc attribute, allowing injection of arbitrary JavaScript that executes when the content is rendered via |raw in templates.

Root Cause

src/Graby.php lines 1038-1048:

htmLawed($html, [
    'safe' => 1,                    // removes <iframe>
    'elements' => '*+iframe-meta',  // re-adds <iframe>, overrides safe=1
    'deny_attribute' => 'style',    // srcdoc is NOT denied
]);

The safe=1 and +iframe combination is a conflict: safe mode is designed to strip dangerous elements, but the elements override re-enables <iframe> without also blocking the dangerous srcdoc attribute.

Proof of Concept

Input to cleanupXss():

<iframe srcdoc="&lt;script&gt;alert(document.domain)&lt;/script&gt;"></iframe>

Output (unchanged — htmLawed passes it through):

<iframe srcdoc="&lt;script&gt;alert(document.domain)&lt;/script&gt;"></iframe>

When rendered via {{ content|raw }} in a template, srcdoc executes in an about:srcdoc frame with the same origin as the page. Confirmed via Puppeteer/Chromium headless: alert(document.domain) fires.

Validated on Wallabag (which uses Graby) via Docker: entry created via API with iframe-only content body triggers Readability failure → falls through to cleanupXss() path.

Impact

Stored XSS in any application rendering Graby-sanitized content via |raw
In Wallabag: affects both authenticated views and public share pages (unauthenticated)
No CSP headers in default Wallabag config — no secondary mitigation

Suggested Fix

Either remove +iframe from the elements config to keep iframes blocked:

'elements' => '*-iframe-meta',

Or explicitly deny the srcdoc attribute:

'deny_attribute' => 'style srcdoc',

Credit

Discovered by @tikket1, 2026-03-25. Redirected from wallabag/wallabag advisory by @j0k3r.

Affected versions


          1.0.0


          1.0.0-alpha.0


          1.0.0-alpha.1


          1.0.0-alpha.2


          1.0.1


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.0.6


          1.0.7


          1.0.8

+ 82 more


            1.1.0


            1.10.0


            1.10.1


            1.11.0


            1.11.1


            1.12.0


            1.12.1


            1.13.0


            1.13.1


            1.13.2


            1.13.3


            1.13.4


            1.13.5


            1.13.6


            1.14.0


            1.15.0


            1.15.1


            1.15.2


            1.15.3


            1.15.4


            1.15.5


            1.16.0


            1.17.0


            1.18.0


            1.18.1


            1.19.0


            1.19.1


            1.2.0


            1.20.0


            1.20.1


            1.3.0


            1.4.0


            1.4.1


            1.4.2


            1.4.3


            1.4.4


            1.4.5


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.4


            1.6.0


            1.6.1


            1.6.2


            1.7.0


            1.7.1


            1.8.0


            1.8.1


            1.8.2


            1.9.0


            1.9.1


            1.9.2


            1.9.3


            2.0.0


            2.0.0-alpha.0


            2.0.1


            2.0.2


            2.1.0


            2.1.1


            2.2.0


            2.2.1


            2.2.4


            2.2.5


            2.2.6


            2.2.7


            2.3.0


            2.3.1


            2.3.2


            2.3.3


            2.3.4


            2.3.5


            2.4.0


            2.4.1


            2.4.2


            2.4.3


            2.4.4


            2.4.5


            2.4.6


            v2.2.2


            v2.2.3


            v2.5.0

Fixed in


          2.5.1

References

Updated Mar 31, 2026 · Source: OSV.dev

Nov 12, 2019

2.0.2 patch

1 CVE

GHSA-3h6j-9x8m-rg3g Mar 31, 2026

Graby has stored XSS via iframe srcdoc Attribute in htmLawed Sanitization Config

Low

Network Low None

Summary

Graby's cleanupXss() function configures htmLawed with conflicting settings: safe=1 (which removes <iframe>) combined with 'elements' => '*+iframe-meta' (which re-enables <iframe>). htmLawed does not sanitize the srcdoc attribute, allowing injection of arbitrary JavaScript that executes when the content is rendered via |raw in templates.

Root Cause

src/Graby.php lines 1038-1048:

htmLawed($html, [
    'safe' => 1,                    // removes <iframe>
    'elements' => '*+iframe-meta',  // re-adds <iframe>, overrides safe=1
    'deny_attribute' => 'style',    // srcdoc is NOT denied
]);

The safe=1 and +iframe combination is a conflict: safe mode is designed to strip dangerous elements, but the elements override re-enables <iframe> without also blocking the dangerous srcdoc attribute.

Proof of Concept

Input to cleanupXss():

<iframe srcdoc="&lt;script&gt;alert(document.domain)&lt;/script&gt;"></iframe>

Output (unchanged — htmLawed passes it through):

<iframe srcdoc="&lt;script&gt;alert(document.domain)&lt;/script&gt;"></iframe>

When rendered via {{ content|raw }} in a template, srcdoc executes in an about:srcdoc frame with the same origin as the page. Confirmed via Puppeteer/Chromium headless: alert(document.domain) fires.

Validated on Wallabag (which uses Graby) via Docker: entry created via API with iframe-only content body triggers Readability failure → falls through to cleanupXss() path.

Impact

Stored XSS in any application rendering Graby-sanitized content via |raw
In Wallabag: affects both authenticated views and public share pages (unauthenticated)
No CSP headers in default Wallabag config — no secondary mitigation

Suggested Fix

Either remove +iframe from the elements config to keep iframes blocked:

'elements' => '*-iframe-meta',

Or explicitly deny the srcdoc attribute:

'deny_attribute' => 'style srcdoc',

Credit

Discovered by @tikket1, 2026-03-25. Redirected from wallabag/wallabag advisory by @j0k3r.

Affected versions


          1.0.0


          1.0.0-alpha.0


          1.0.0-alpha.1


          1.0.0-alpha.2


          1.0.1


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.0.6


          1.0.7


          1.0.8

+ 82 more


            1.1.0


            1.10.0


            1.10.1


            1.11.0


            1.11.1


            1.12.0


            1.12.1


            1.13.0


            1.13.1


            1.13.2


            1.13.3


            1.13.4


            1.13.5


            1.13.6


            1.14.0


            1.15.0


            1.15.1


            1.15.2


            1.15.3


            1.15.4


            1.15.5


            1.16.0


            1.17.0


            1.18.0


            1.18.1


            1.19.0


            1.19.1


            1.2.0


            1.20.0


            1.20.1


            1.3.0


            1.4.0


            1.4.1


            1.4.2


            1.4.3


            1.4.4


            1.4.5


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.4


            1.6.0


            1.6.1


            1.6.2


            1.7.0


            1.7.1


            1.8.0


            1.8.1


            1.8.2


            1.9.0


            1.9.1


            1.9.2


            1.9.3


            2.0.0


            2.0.0-alpha.0


            2.0.1


            2.0.2


            2.1.0


            2.1.1


            2.2.0


            2.2.1


            2.2.4


            2.2.5


            2.2.6


            2.2.7


            2.3.0


            2.3.1


            2.3.2


            2.3.3


            2.3.4


            2.3.5


            2.4.0


            2.4.1


            2.4.2


            2.4.3


            2.4.4


            2.4.5


            2.4.6


            v2.2.2


            v2.2.3


            v2.5.0

Fixed in


          2.5.1

References

Updated Mar 31, 2026 · Source: OSV.dev

Jul 22, 2019

2.0.1 patch

1 CVE

GHSA-3h6j-9x8m-rg3g Mar 31, 2026

Graby has stored XSS via iframe srcdoc Attribute in htmLawed Sanitization Config

Low

Network Low None

Summary

Graby's cleanupXss() function configures htmLawed with conflicting settings: safe=1 (which removes <iframe>) combined with 'elements' => '*+iframe-meta' (which re-enables <iframe>). htmLawed does not sanitize the srcdoc attribute, allowing injection of arbitrary JavaScript that executes when the content is rendered via |raw in templates.

Root Cause

src/Graby.php lines 1038-1048:

htmLawed($html, [
    'safe' => 1,                    // removes <iframe>
    'elements' => '*+iframe-meta',  // re-adds <iframe>, overrides safe=1
    'deny_attribute' => 'style',    // srcdoc is NOT denied
]);

The safe=1 and +iframe combination is a conflict: safe mode is designed to strip dangerous elements, but the elements override re-enables <iframe> without also blocking the dangerous srcdoc attribute.

Proof of Concept

Input to cleanupXss():

<iframe srcdoc="&lt;script&gt;alert(document.domain)&lt;/script&gt;"></iframe>

Output (unchanged — htmLawed passes it through):

<iframe srcdoc="&lt;script&gt;alert(document.domain)&lt;/script&gt;"></iframe>

When rendered via {{ content|raw }} in a template, srcdoc executes in an about:srcdoc frame with the same origin as the page. Confirmed via Puppeteer/Chromium headless: alert(document.domain) fires.

Validated on Wallabag (which uses Graby) via Docker: entry created via API with iframe-only content body triggers Readability failure → falls through to cleanupXss() path.

Impact

Stored XSS in any application rendering Graby-sanitized content via |raw
In Wallabag: affects both authenticated views and public share pages (unauthenticated)
No CSP headers in default Wallabag config — no secondary mitigation

Suggested Fix

Either remove +iframe from the elements config to keep iframes blocked:

'elements' => '*-iframe-meta',

Or explicitly deny the srcdoc attribute:

'deny_attribute' => 'style srcdoc',

Credit

Discovered by @tikket1, 2026-03-25. Redirected from wallabag/wallabag advisory by @j0k3r.

Affected versions


          1.0.0


          1.0.0-alpha.0


          1.0.0-alpha.1


          1.0.0-alpha.2


          1.0.1


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.0.6


          1.0.7


          1.0.8

+ 82 more


            1.1.0


            1.10.0


            1.10.1


            1.11.0


            1.11.1


            1.12.0


            1.12.1


            1.13.0


            1.13.1


            1.13.2


            1.13.3


            1.13.4


            1.13.5


            1.13.6


            1.14.0


            1.15.0


            1.15.1


            1.15.2


            1.15.3


            1.15.4


            1.15.5


            1.16.0


            1.17.0


            1.18.0


            1.18.1


            1.19.0


            1.19.1


            1.2.0


            1.20.0


            1.20.1


            1.3.0


            1.4.0


            1.4.1


            1.4.2


            1.4.3


            1.4.4


            1.4.5


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.4


            1.6.0


            1.6.1


            1.6.2


            1.7.0


            1.7.1


            1.8.0


            1.8.1


            1.8.2


            1.9.0


            1.9.1


            1.9.2


            1.9.3


            2.0.0


            2.0.0-alpha.0


            2.0.1


            2.0.2


            2.1.0


            2.1.1


            2.2.0


            2.2.1


            2.2.4


            2.2.5


            2.2.6


            2.2.7


            2.3.0


            2.3.1


            2.3.2


            2.3.3


            2.3.4


            2.3.5


            2.4.0


            2.4.1


            2.4.2


            2.4.3


            2.4.4


            2.4.5


            2.4.6


            v2.2.2


            v2.2.3


            v2.5.0

Fixed in


          2.5.1

References

Updated Mar 31, 2026 · Source: OSV.dev

Jun 27, 2019

2.0.0 major

1 CVE

GHSA-3h6j-9x8m-rg3g Mar 31, 2026

Graby has stored XSS via iframe srcdoc Attribute in htmLawed Sanitization Config

Low

Network Low None

Summary

Graby's cleanupXss() function configures htmLawed with conflicting settings: safe=1 (which removes <iframe>) combined with 'elements' => '*+iframe-meta' (which re-enables <iframe>). htmLawed does not sanitize the srcdoc attribute, allowing injection of arbitrary JavaScript that executes when the content is rendered via |raw in templates.

Root Cause

src/Graby.php lines 1038-1048:

htmLawed($html, [
    'safe' => 1,                    // removes <iframe>
    'elements' => '*+iframe-meta',  // re-adds <iframe>, overrides safe=1
    'deny_attribute' => 'style',    // srcdoc is NOT denied
]);

The safe=1 and +iframe combination is a conflict: safe mode is designed to strip dangerous elements, but the elements override re-enables <iframe> without also blocking the dangerous srcdoc attribute.

Proof of Concept

Input to cleanupXss():

<iframe srcdoc="&lt;script&gt;alert(document.domain)&lt;/script&gt;"></iframe>

Output (unchanged — htmLawed passes it through):

<iframe srcdoc="&lt;script&gt;alert(document.domain)&lt;/script&gt;"></iframe>

When rendered via {{ content|raw }} in a template, srcdoc executes in an about:srcdoc frame with the same origin as the page. Confirmed via Puppeteer/Chromium headless: alert(document.domain) fires.

Validated on Wallabag (which uses Graby) via Docker: entry created via API with iframe-only content body triggers Readability failure → falls through to cleanupXss() path.

Impact

Stored XSS in any application rendering Graby-sanitized content via |raw
In Wallabag: affects both authenticated views and public share pages (unauthenticated)
No CSP headers in default Wallabag config — no secondary mitigation

Suggested Fix

Either remove +iframe from the elements config to keep iframes blocked:

'elements' => '*-iframe-meta',

Or explicitly deny the srcdoc attribute:

'deny_attribute' => 'style srcdoc',

Credit

Discovered by @tikket1, 2026-03-25. Redirected from wallabag/wallabag advisory by @j0k3r.

Affected versions


          1.0.0


          1.0.0-alpha.0


          1.0.0-alpha.1


          1.0.0-alpha.2


          1.0.1


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.0.6


          1.0.7


          1.0.8

+ 82 more


            1.1.0


            1.10.0


            1.10.1


            1.11.0


            1.11.1


            1.12.0


            1.12.1


            1.13.0


            1.13.1


            1.13.2


            1.13.3


            1.13.4


            1.13.5


            1.13.6


            1.14.0


            1.15.0


            1.15.1


            1.15.2


            1.15.3


            1.15.4


            1.15.5


            1.16.0


            1.17.0


            1.18.0


            1.18.1


            1.19.0


            1.19.1


            1.2.0


            1.20.0


            1.20.1


            1.3.0


            1.4.0


            1.4.1


            1.4.2


            1.4.3


            1.4.4


            1.4.5


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.4


            1.6.0


            1.6.1


            1.6.2


            1.7.0


            1.7.1


            1.8.0


            1.8.1


            1.8.2


            1.9.0


            1.9.1


            1.9.2


            1.9.3


            2.0.0


            2.0.0-alpha.0


            2.0.1


            2.0.2


            2.1.0


            2.1.1


            2.2.0


            2.2.1


            2.2.4


            2.2.5


            2.2.6


            2.2.7


            2.3.0


            2.3.1


            2.3.2


            2.3.3


            2.3.4


            2.3.5


            2.4.0


            2.4.1


            2.4.2


            2.4.3


            2.4.4


            2.4.5


            2.4.6


            v2.2.2


            v2.2.3


            v2.5.0

Fixed in


          2.5.1

References

Updated Mar 31, 2026 · Source: OSV.dev

May 22, 2019

1.20.1 patch

1 CVE

GHSA-3h6j-9x8m-rg3g Mar 31, 2026

Graby has stored XSS via iframe srcdoc Attribute in htmLawed Sanitization Config

Low

Network Low None

Summary

Graby's cleanupXss() function configures htmLawed with conflicting settings: safe=1 (which removes <iframe>) combined with 'elements' => '*+iframe-meta' (which re-enables <iframe>). htmLawed does not sanitize the srcdoc attribute, allowing injection of arbitrary JavaScript that executes when the content is rendered via |raw in templates.

Root Cause

src/Graby.php lines 1038-1048:

htmLawed($html, [
    'safe' => 1,                    // removes <iframe>
    'elements' => '*+iframe-meta',  // re-adds <iframe>, overrides safe=1
    'deny_attribute' => 'style',    // srcdoc is NOT denied
]);

The safe=1 and +iframe combination is a conflict: safe mode is designed to strip dangerous elements, but the elements override re-enables <iframe> without also blocking the dangerous srcdoc attribute.

Proof of Concept

Input to cleanupXss():

<iframe srcdoc="&lt;script&gt;alert(document.domain)&lt;/script&gt;"></iframe>

Output (unchanged — htmLawed passes it through):

<iframe srcdoc="&lt;script&gt;alert(document.domain)&lt;/script&gt;"></iframe>

When rendered via {{ content|raw }} in a template, srcdoc executes in an about:srcdoc frame with the same origin as the page. Confirmed via Puppeteer/Chromium headless: alert(document.domain) fires.

Validated on Wallabag (which uses Graby) via Docker: entry created via API with iframe-only content body triggers Readability failure → falls through to cleanupXss() path.

Impact

Stored XSS in any application rendering Graby-sanitized content via |raw
In Wallabag: affects both authenticated views and public share pages (unauthenticated)
No CSP headers in default Wallabag config — no secondary mitigation

Suggested Fix

Either remove +iframe from the elements config to keep iframes blocked:

'elements' => '*-iframe-meta',

Or explicitly deny the srcdoc attribute:

'deny_attribute' => 'style srcdoc',

Credit

Discovered by @tikket1, 2026-03-25. Redirected from wallabag/wallabag advisory by @j0k3r.

Affected versions


          1.0.0


          1.0.0-alpha.0


          1.0.0-alpha.1


          1.0.0-alpha.2


          1.0.1


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.0.6


          1.0.7


          1.0.8

+ 82 more


            1.1.0


            1.10.0


            1.10.1


            1.11.0


            1.11.1


            1.12.0


            1.12.1


            1.13.0


            1.13.1


            1.13.2


            1.13.3


            1.13.4


            1.13.5


            1.13.6


            1.14.0


            1.15.0


            1.15.1


            1.15.2


            1.15.3


            1.15.4


            1.15.5


            1.16.0


            1.17.0


            1.18.0


            1.18.1


            1.19.0


            1.19.1


            1.2.0


            1.20.0


            1.20.1


            1.3.0


            1.4.0


            1.4.1


            1.4.2


            1.4.3


            1.4.4


            1.4.5


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.4


            1.6.0


            1.6.1


            1.6.2


            1.7.0


            1.7.1


            1.8.0


            1.8.1


            1.8.2


            1.9.0


            1.9.1


            1.9.2


            1.9.3


            2.0.0


            2.0.0-alpha.0


            2.0.1


            2.0.2


            2.1.0


            2.1.1


            2.2.0


            2.2.1


            2.2.4


            2.2.5


            2.2.6


            2.2.7


            2.3.0


            2.3.1


            2.3.2


            2.3.3


            2.3.4


            2.3.5


            2.4.0


            2.4.1


            2.4.2


            2.4.3


            2.4.4


            2.4.5


            2.4.6


            v2.2.2


            v2.2.3


            v2.5.0

Fixed in


          2.5.1

References

Updated Mar 31, 2026 · Source: OSV.dev

May 14, 2019

1.20.0 minor

1 CVE

GHSA-3h6j-9x8m-rg3g Mar 31, 2026

Graby has stored XSS via iframe srcdoc Attribute in htmLawed Sanitization Config

Low

Network Low None

Summary

Graby's cleanupXss() function configures htmLawed with conflicting settings: safe=1 (which removes <iframe>) combined with 'elements' => '*+iframe-meta' (which re-enables <iframe>). htmLawed does not sanitize the srcdoc attribute, allowing injection of arbitrary JavaScript that executes when the content is rendered via |raw in templates.

Root Cause

src/Graby.php lines 1038-1048:

htmLawed($html, [
    'safe' => 1,                    // removes <iframe>
    'elements' => '*+iframe-meta',  // re-adds <iframe>, overrides safe=1
    'deny_attribute' => 'style',    // srcdoc is NOT denied
]);

The safe=1 and +iframe combination is a conflict: safe mode is designed to strip dangerous elements, but the elements override re-enables <iframe> without also blocking the dangerous srcdoc attribute.

Proof of Concept

Input to cleanupXss():

<iframe srcdoc="&lt;script&gt;alert(document.domain)&lt;/script&gt;"></iframe>

Output (unchanged — htmLawed passes it through):

<iframe srcdoc="&lt;script&gt;alert(document.domain)&lt;/script&gt;"></iframe>

When rendered via {{ content|raw }} in a template, srcdoc executes in an about:srcdoc frame with the same origin as the page. Confirmed via Puppeteer/Chromium headless: alert(document.domain) fires.

Validated on Wallabag (which uses Graby) via Docker: entry created via API with iframe-only content body triggers Readability failure → falls through to cleanupXss() path.

Impact

Stored XSS in any application rendering Graby-sanitized content via |raw
In Wallabag: affects both authenticated views and public share pages (unauthenticated)
No CSP headers in default Wallabag config — no secondary mitigation

Suggested Fix

Either remove +iframe from the elements config to keep iframes blocked:

'elements' => '*-iframe-meta',

Or explicitly deny the srcdoc attribute:

'deny_attribute' => 'style srcdoc',

Credit

Discovered by @tikket1, 2026-03-25. Redirected from wallabag/wallabag advisory by @j0k3r.

Affected versions


          1.0.0


          1.0.0-alpha.0


          1.0.0-alpha.1


          1.0.0-alpha.2


          1.0.1


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.0.6


          1.0.7


          1.0.8

+ 82 more


            1.1.0


            1.10.0


            1.10.1


            1.11.0


            1.11.1


            1.12.0


            1.12.1


            1.13.0


            1.13.1


            1.13.2


            1.13.3


            1.13.4


            1.13.5


            1.13.6


            1.14.0


            1.15.0


            1.15.1


            1.15.2


            1.15.3


            1.15.4


            1.15.5


            1.16.0


            1.17.0


            1.18.0


            1.18.1


            1.19.0


            1.19.1


            1.2.0


            1.20.0


            1.20.1


            1.3.0


            1.4.0


            1.4.1


            1.4.2


            1.4.3


            1.4.4


            1.4.5


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.4


            1.6.0


            1.6.1


            1.6.2


            1.7.0


            1.7.1


            1.8.0


            1.8.1


            1.8.2


            1.9.0


            1.9.1


            1.9.2


            1.9.3


            2.0.0


            2.0.0-alpha.0


            2.0.1


            2.0.2


            2.1.0


            2.1.1


            2.2.0


            2.2.1


            2.2.4


            2.2.5


            2.2.6


            2.2.7


            2.3.0


            2.3.1


            2.3.2


            2.3.3


            2.3.4


            2.3.5


            2.4.0


            2.4.1


            2.4.2


            2.4.3


            2.4.4


            2.4.5


            2.4.6


            v2.2.2


            v2.2.3


            v2.5.0

Fixed in


          2.5.1

References

Updated Mar 31, 2026 · Source: OSV.dev

May 11, 2019

1.19.1 patch

1 CVE

GHSA-3h6j-9x8m-rg3g Mar 31, 2026

Graby has stored XSS via iframe srcdoc Attribute in htmLawed Sanitization Config

Low

Network Low None

Summary

Graby's cleanupXss() function configures htmLawed with conflicting settings: safe=1 (which removes <iframe>) combined with 'elements' => '*+iframe-meta' (which re-enables <iframe>). htmLawed does not sanitize the srcdoc attribute, allowing injection of arbitrary JavaScript that executes when the content is rendered via |raw in templates.

Root Cause

src/Graby.php lines 1038-1048:

htmLawed($html, [
    'safe' => 1,                    // removes <iframe>
    'elements' => '*+iframe-meta',  // re-adds <iframe>, overrides safe=1
    'deny_attribute' => 'style',    // srcdoc is NOT denied
]);

The safe=1 and +iframe combination is a conflict: safe mode is designed to strip dangerous elements, but the elements override re-enables <iframe> without also blocking the dangerous srcdoc attribute.

Proof of Concept

Input to cleanupXss():

<iframe srcdoc="&lt;script&gt;alert(document.domain)&lt;/script&gt;"></iframe>

Output (unchanged — htmLawed passes it through):

<iframe srcdoc="&lt;script&gt;alert(document.domain)&lt;/script&gt;"></iframe>

When rendered via {{ content|raw }} in a template, srcdoc executes in an about:srcdoc frame with the same origin as the page. Confirmed via Puppeteer/Chromium headless: alert(document.domain) fires.

Validated on Wallabag (which uses Graby) via Docker: entry created via API with iframe-only content body triggers Readability failure → falls through to cleanupXss() path.

Impact

Stored XSS in any application rendering Graby-sanitized content via |raw
In Wallabag: affects both authenticated views and public share pages (unauthenticated)
No CSP headers in default Wallabag config — no secondary mitigation

Suggested Fix

Either remove +iframe from the elements config to keep iframes blocked:

'elements' => '*-iframe-meta',

Or explicitly deny the srcdoc attribute:

'deny_attribute' => 'style srcdoc',

Credit

Discovered by @tikket1, 2026-03-25. Redirected from wallabag/wallabag advisory by @j0k3r.

Affected versions


          1.0.0


          1.0.0-alpha.0


          1.0.0-alpha.1


          1.0.0-alpha.2


          1.0.1


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.0.6


          1.0.7


          1.0.8

+ 82 more


            1.1.0


            1.10.0


            1.10.1


            1.11.0


            1.11.1


            1.12.0


            1.12.1


            1.13.0


            1.13.1


            1.13.2


            1.13.3


            1.13.4


            1.13.5


            1.13.6


            1.14.0


            1.15.0


            1.15.1


            1.15.2


            1.15.3


            1.15.4


            1.15.5


            1.16.0


            1.17.0


            1.18.0


            1.18.1


            1.19.0


            1.19.1


            1.2.0


            1.20.0


            1.20.1


            1.3.0


            1.4.0


            1.4.1


            1.4.2


            1.4.3


            1.4.4


            1.4.5


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.4


            1.6.0


            1.6.1


            1.6.2


            1.7.0


            1.7.1


            1.8.0


            1.8.1


            1.8.2


            1.9.0


            1.9.1


            1.9.2


            1.9.3


            2.0.0


            2.0.0-alpha.0


            2.0.1


            2.0.2


            2.1.0


            2.1.1


            2.2.0


            2.2.1


            2.2.4


            2.2.5


            2.2.6


            2.2.7


            2.3.0


            2.3.1


            2.3.2


            2.3.3


            2.3.4


            2.3.5


            2.4.0


            2.4.1


            2.4.2


            2.4.3


            2.4.4


            2.4.5


            2.4.6


            v2.2.2


            v2.2.3


            v2.5.0

Fixed in


          2.5.1

References

Updated Mar 31, 2026 · Source: OSV.dev

Feb 13, 2019

2.0.0-alpha.0 pre

1 CVE

GHSA-3h6j-9x8m-rg3g Mar 31, 2026

Graby has stored XSS via iframe srcdoc Attribute in htmLawed Sanitization Config

Low

Network Low None

Summary

Graby's cleanupXss() function configures htmLawed with conflicting settings: safe=1 (which removes <iframe>) combined with 'elements' => '*+iframe-meta' (which re-enables <iframe>). htmLawed does not sanitize the srcdoc attribute, allowing injection of arbitrary JavaScript that executes when the content is rendered via |raw in templates.

Root Cause

src/Graby.php lines 1038-1048:

htmLawed($html, [
    'safe' => 1,                    // removes <iframe>
    'elements' => '*+iframe-meta',  // re-adds <iframe>, overrides safe=1
    'deny_attribute' => 'style',    // srcdoc is NOT denied
]);

The safe=1 and +iframe combination is a conflict: safe mode is designed to strip dangerous elements, but the elements override re-enables <iframe> without also blocking the dangerous srcdoc attribute.

Proof of Concept

Input to cleanupXss():

<iframe srcdoc="&lt;script&gt;alert(document.domain)&lt;/script&gt;"></iframe>

Output (unchanged — htmLawed passes it through):

<iframe srcdoc="&lt;script&gt;alert(document.domain)&lt;/script&gt;"></iframe>

When rendered via {{ content|raw }} in a template, srcdoc executes in an about:srcdoc frame with the same origin as the page. Confirmed via Puppeteer/Chromium headless: alert(document.domain) fires.

Validated on Wallabag (which uses Graby) via Docker: entry created via API with iframe-only content body triggers Readability failure → falls through to cleanupXss() path.

Impact

Stored XSS in any application rendering Graby-sanitized content via |raw
In Wallabag: affects both authenticated views and public share pages (unauthenticated)
No CSP headers in default Wallabag config — no secondary mitigation

Suggested Fix

Either remove +iframe from the elements config to keep iframes blocked:

'elements' => '*-iframe-meta',

Or explicitly deny the srcdoc attribute:

'deny_attribute' => 'style srcdoc',

Credit

Discovered by @tikket1, 2026-03-25. Redirected from wallabag/wallabag advisory by @j0k3r.

Affected versions


          1.0.0


          1.0.0-alpha.0


          1.0.0-alpha.1


          1.0.0-alpha.2


          1.0.1


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.0.6


          1.0.7


          1.0.8

+ 82 more


            1.1.0


            1.10.0


            1.10.1


            1.11.0


            1.11.1


            1.12.0


            1.12.1


            1.13.0


            1.13.1


            1.13.2


            1.13.3


            1.13.4


            1.13.5


            1.13.6


            1.14.0


            1.15.0


            1.15.1


            1.15.2


            1.15.3


            1.15.4


            1.15.5


            1.16.0


            1.17.0


            1.18.0


            1.18.1


            1.19.0


            1.19.1


            1.2.0


            1.20.0


            1.20.1


            1.3.0


            1.4.0


            1.4.1


            1.4.2


            1.4.3


            1.4.4


            1.4.5


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.4


            1.6.0


            1.6.1


            1.6.2


            1.7.0


            1.7.1


            1.8.0


            1.8.1


            1.8.2


            1.9.0


            1.9.1


            1.9.2


            1.9.3


            2.0.0


            2.0.0-alpha.0


            2.0.1


            2.0.2


            2.1.0


            2.1.1


            2.2.0


            2.2.1


            2.2.4


            2.2.5


            2.2.6


            2.2.7


            2.3.0


            2.3.1


            2.3.2


            2.3.3


            2.3.4


            2.3.5


            2.4.0


            2.4.1


            2.4.2


            2.4.3


            2.4.4


            2.4.5


            2.4.6


            v2.2.2


            v2.2.3


            v2.5.0

Fixed in


          2.5.1

References

Updated Mar 31, 2026 · Source: OSV.dev

Jan 26, 2019

1.19.0 minor

1 CVE

GHSA-3h6j-9x8m-rg3g Mar 31, 2026

Graby has stored XSS via iframe srcdoc Attribute in htmLawed Sanitization Config

Low

Network Low None

Summary

Graby's cleanupXss() function configures htmLawed with conflicting settings: safe=1 (which removes <iframe>) combined with 'elements' => '*+iframe-meta' (which re-enables <iframe>). htmLawed does not sanitize the srcdoc attribute, allowing injection of arbitrary JavaScript that executes when the content is rendered via |raw in templates.

Root Cause

src/Graby.php lines 1038-1048:

htmLawed($html, [
    'safe' => 1,                    // removes <iframe>
    'elements' => '*+iframe-meta',  // re-adds <iframe>, overrides safe=1
    'deny_attribute' => 'style',    // srcdoc is NOT denied
]);

The safe=1 and +iframe combination is a conflict: safe mode is designed to strip dangerous elements, but the elements override re-enables <iframe> without also blocking the dangerous srcdoc attribute.

Proof of Concept

Input to cleanupXss():

<iframe srcdoc="&lt;script&gt;alert(document.domain)&lt;/script&gt;"></iframe>

Output (unchanged — htmLawed passes it through):

<iframe srcdoc="&lt;script&gt;alert(document.domain)&lt;/script&gt;"></iframe>

When rendered via {{ content|raw }} in a template, srcdoc executes in an about:srcdoc frame with the same origin as the page. Confirmed via Puppeteer/Chromium headless: alert(document.domain) fires.

Validated on Wallabag (which uses Graby) via Docker: entry created via API with iframe-only content body triggers Readability failure → falls through to cleanupXss() path.

Impact

Stored XSS in any application rendering Graby-sanitized content via |raw
In Wallabag: affects both authenticated views and public share pages (unauthenticated)
No CSP headers in default Wallabag config — no secondary mitigation

Suggested Fix

Either remove +iframe from the elements config to keep iframes blocked:

'elements' => '*-iframe-meta',

Or explicitly deny the srcdoc attribute:

'deny_attribute' => 'style srcdoc',

Credit

Discovered by @tikket1, 2026-03-25. Redirected from wallabag/wallabag advisory by @j0k3r.

Affected versions


          1.0.0


          1.0.0-alpha.0


          1.0.0-alpha.1


          1.0.0-alpha.2


          1.0.1


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.0.6


          1.0.7


          1.0.8

+ 82 more


            1.1.0


            1.10.0


            1.10.1


            1.11.0


            1.11.1


            1.12.0


            1.12.1


            1.13.0


            1.13.1


            1.13.2


            1.13.3


            1.13.4


            1.13.5


            1.13.6


            1.14.0


            1.15.0


            1.15.1


            1.15.2


            1.15.3


            1.15.4


            1.15.5


            1.16.0


            1.17.0


            1.18.0


            1.18.1


            1.19.0


            1.19.1


            1.2.0


            1.20.0


            1.20.1


            1.3.0


            1.4.0


            1.4.1


            1.4.2


            1.4.3


            1.4.4


            1.4.5


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.4


            1.6.0


            1.6.1


            1.6.2


            1.7.0


            1.7.1


            1.8.0


            1.8.1


            1.8.2


            1.9.0


            1.9.1


            1.9.2


            1.9.3


            2.0.0


            2.0.0-alpha.0


            2.0.1


            2.0.2


            2.1.0


            2.1.1


            2.2.0


            2.2.1


            2.2.4


            2.2.5


            2.2.6


            2.2.7


            2.3.0


            2.3.1


            2.3.2


            2.3.3


            2.3.4


            2.3.5


            2.4.0


            2.4.1


            2.4.2


            2.4.3


            2.4.4


            2.4.5


            2.4.6


            v2.2.2


            v2.2.3


            v2.5.0

Fixed in


          2.5.1

References

Updated Mar 31, 2026 · Source: OSV.dev

Jan 22, 2019

1.18.1 patch

1 CVE

GHSA-3h6j-9x8m-rg3g Mar 31, 2026

Graby has stored XSS via iframe srcdoc Attribute in htmLawed Sanitization Config

Low

Network Low None

Summary

Graby's cleanupXss() function configures htmLawed with conflicting settings: safe=1 (which removes <iframe>) combined with 'elements' => '*+iframe-meta' (which re-enables <iframe>). htmLawed does not sanitize the srcdoc attribute, allowing injection of arbitrary JavaScript that executes when the content is rendered via |raw in templates.

Root Cause

src/Graby.php lines 1038-1048:

htmLawed($html, [
    'safe' => 1,                    // removes <iframe>
    'elements' => '*+iframe-meta',  // re-adds <iframe>, overrides safe=1
    'deny_attribute' => 'style',    // srcdoc is NOT denied
]);

The safe=1 and +iframe combination is a conflict: safe mode is designed to strip dangerous elements, but the elements override re-enables <iframe> without also blocking the dangerous srcdoc attribute.

Proof of Concept

Input to cleanupXss():

<iframe srcdoc="&lt;script&gt;alert(document.domain)&lt;/script&gt;"></iframe>

Output (unchanged — htmLawed passes it through):

<iframe srcdoc="&lt;script&gt;alert(document.domain)&lt;/script&gt;"></iframe>

When rendered via {{ content|raw }} in a template, srcdoc executes in an about:srcdoc frame with the same origin as the page. Confirmed via Puppeteer/Chromium headless: alert(document.domain) fires.

Validated on Wallabag (which uses Graby) via Docker: entry created via API with iframe-only content body triggers Readability failure → falls through to cleanupXss() path.

Impact

Stored XSS in any application rendering Graby-sanitized content via |raw
In Wallabag: affects both authenticated views and public share pages (unauthenticated)
No CSP headers in default Wallabag config — no secondary mitigation

Suggested Fix

Either remove +iframe from the elements config to keep iframes blocked:

'elements' => '*-iframe-meta',

Or explicitly deny the srcdoc attribute:

'deny_attribute' => 'style srcdoc',

Credit

Discovered by @tikket1, 2026-03-25. Redirected from wallabag/wallabag advisory by @j0k3r.

Affected versions


          1.0.0


          1.0.0-alpha.0


          1.0.0-alpha.1


          1.0.0-alpha.2


          1.0.1


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.0.6


          1.0.7


          1.0.8

+ 82 more


            1.1.0


            1.10.0


            1.10.1


            1.11.0


            1.11.1


            1.12.0


            1.12.1


            1.13.0


            1.13.1


            1.13.2


            1.13.3


            1.13.4


            1.13.5


            1.13.6


            1.14.0


            1.15.0


            1.15.1


            1.15.2


            1.15.3


            1.15.4


            1.15.5


            1.16.0


            1.17.0


            1.18.0


            1.18.1


            1.19.0


            1.19.1


            1.2.0


            1.20.0


            1.20.1


            1.3.0


            1.4.0


            1.4.1


            1.4.2


            1.4.3


            1.4.4


            1.4.5


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.4


            1.6.0


            1.6.1


            1.6.2


            1.7.0


            1.7.1


            1.8.0


            1.8.1


            1.8.2


            1.9.0


            1.9.1


            1.9.2


            1.9.3


            2.0.0


            2.0.0-alpha.0


            2.0.1


            2.0.2


            2.1.0


            2.1.1


            2.2.0


            2.2.1


            2.2.4


            2.2.5


            2.2.6


            2.2.7


            2.3.0


            2.3.1


            2.3.2


            2.3.3


            2.3.4


            2.3.5


            2.4.0


            2.4.1


            2.4.2


            2.4.3


            2.4.4


            2.4.5


            2.4.6


            v2.2.2


            v2.2.3


            v2.5.0

Fixed in


          2.5.1

References

Updated Mar 31, 2026 · Source: OSV.dev

Jan 21, 2019

1.18.0 minor

1 CVE

GHSA-3h6j-9x8m-rg3g Mar 31, 2026

Graby has stored XSS via iframe srcdoc Attribute in htmLawed Sanitization Config

Low

Network Low None

Summary

Graby's cleanupXss() function configures htmLawed with conflicting settings: safe=1 (which removes <iframe>) combined with 'elements' => '*+iframe-meta' (which re-enables <iframe>). htmLawed does not sanitize the srcdoc attribute, allowing injection of arbitrary JavaScript that executes when the content is rendered via |raw in templates.

Root Cause

src/Graby.php lines 1038-1048:

htmLawed($html, [
    'safe' => 1,                    // removes <iframe>
    'elements' => '*+iframe-meta',  // re-adds <iframe>, overrides safe=1
    'deny_attribute' => 'style',    // srcdoc is NOT denied
]);

The safe=1 and +iframe combination is a conflict: safe mode is designed to strip dangerous elements, but the elements override re-enables <iframe> without also blocking the dangerous srcdoc attribute.

Proof of Concept

Input to cleanupXss():

<iframe srcdoc="&lt;script&gt;alert(document.domain)&lt;/script&gt;"></iframe>

Output (unchanged — htmLawed passes it through):

<iframe srcdoc="&lt;script&gt;alert(document.domain)&lt;/script&gt;"></iframe>

When rendered via {{ content|raw }} in a template, srcdoc executes in an about:srcdoc frame with the same origin as the page. Confirmed via Puppeteer/Chromium headless: alert(document.domain) fires.

Validated on Wallabag (which uses Graby) via Docker: entry created via API with iframe-only content body triggers Readability failure → falls through to cleanupXss() path.

Impact

Stored XSS in any application rendering Graby-sanitized content via |raw
In Wallabag: affects both authenticated views and public share pages (unauthenticated)
No CSP headers in default Wallabag config — no secondary mitigation

Suggested Fix

Either remove +iframe from the elements config to keep iframes blocked:

'elements' => '*-iframe-meta',

Or explicitly deny the srcdoc attribute:

'deny_attribute' => 'style srcdoc',

Credit

Discovered by @tikket1, 2026-03-25. Redirected from wallabag/wallabag advisory by @j0k3r.

Affected versions


          1.0.0


          1.0.0-alpha.0


          1.0.0-alpha.1


          1.0.0-alpha.2


          1.0.1


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.0.6


          1.0.7


          1.0.8

+ 82 more


            1.1.0


            1.10.0


            1.10.1


            1.11.0


            1.11.1


            1.12.0


            1.12.1


            1.13.0


            1.13.1


            1.13.2


            1.13.3


            1.13.4


            1.13.5


            1.13.6


            1.14.0


            1.15.0


            1.15.1


            1.15.2


            1.15.3


            1.15.4


            1.15.5


            1.16.0


            1.17.0


            1.18.0


            1.18.1


            1.19.0


            1.19.1


            1.2.0


            1.20.0


            1.20.1


            1.3.0


            1.4.0


            1.4.1


            1.4.2


            1.4.3


            1.4.4


            1.4.5


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.4


            1.6.0


            1.6.1


            1.6.2


            1.7.0


            1.7.1


            1.8.0


            1.8.1


            1.8.2


            1.9.0


            1.9.1


            1.9.2


            1.9.3


            2.0.0


            2.0.0-alpha.0


            2.0.1


            2.0.2


            2.1.0


            2.1.1


            2.2.0


            2.2.1


            2.2.4


            2.2.5


            2.2.6


            2.2.7


            2.3.0


            2.3.1


            2.3.2


            2.3.3


            2.3.4


            2.3.5


            2.4.0


            2.4.1


            2.4.2


            2.4.3


            2.4.4


            2.4.5


            2.4.6


            v2.2.2


            v2.2.3


            v2.5.0

Fixed in


          2.5.1

References

Updated Mar 31, 2026 · Source: OSV.dev

Jan 08, 2019

1.17.0 minor

1 CVE

GHSA-3h6j-9x8m-rg3g Mar 31, 2026

Graby has stored XSS via iframe srcdoc Attribute in htmLawed Sanitization Config

Low

Network Low None

Summary

Graby's cleanupXss() function configures htmLawed with conflicting settings: safe=1 (which removes <iframe>) combined with 'elements' => '*+iframe-meta' (which re-enables <iframe>). htmLawed does not sanitize the srcdoc attribute, allowing injection of arbitrary JavaScript that executes when the content is rendered via |raw in templates.

Root Cause

src/Graby.php lines 1038-1048:

htmLawed($html, [
    'safe' => 1,                    // removes <iframe>
    'elements' => '*+iframe-meta',  // re-adds <iframe>, overrides safe=1
    'deny_attribute' => 'style',    // srcdoc is NOT denied
]);

The safe=1 and +iframe combination is a conflict: safe mode is designed to strip dangerous elements, but the elements override re-enables <iframe> without also blocking the dangerous srcdoc attribute.

Proof of Concept

Input to cleanupXss():

<iframe srcdoc="&lt;script&gt;alert(document.domain)&lt;/script&gt;"></iframe>

Output (unchanged — htmLawed passes it through):

<iframe srcdoc="&lt;script&gt;alert(document.domain)&lt;/script&gt;"></iframe>

When rendered via {{ content|raw }} in a template, srcdoc executes in an about:srcdoc frame with the same origin as the page. Confirmed via Puppeteer/Chromium headless: alert(document.domain) fires.

Validated on Wallabag (which uses Graby) via Docker: entry created via API with iframe-only content body triggers Readability failure → falls through to cleanupXss() path.

Impact

Stored XSS in any application rendering Graby-sanitized content via |raw
In Wallabag: affects both authenticated views and public share pages (unauthenticated)
No CSP headers in default Wallabag config — no secondary mitigation

Suggested Fix

Either remove +iframe from the elements config to keep iframes blocked:

'elements' => '*-iframe-meta',

Or explicitly deny the srcdoc attribute:

'deny_attribute' => 'style srcdoc',

Credit

Discovered by @tikket1, 2026-03-25. Redirected from wallabag/wallabag advisory by @j0k3r.

Affected versions


          1.0.0


          1.0.0-alpha.0


          1.0.0-alpha.1


          1.0.0-alpha.2


          1.0.1


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.0.6


          1.0.7


          1.0.8

+ 82 more


            1.1.0


            1.10.0


            1.10.1


            1.11.0


            1.11.1


            1.12.0


            1.12.1


            1.13.0


            1.13.1


            1.13.2


            1.13.3


            1.13.4


            1.13.5


            1.13.6


            1.14.0


            1.15.0


            1.15.1


            1.15.2


            1.15.3


            1.15.4


            1.15.5


            1.16.0


            1.17.0


            1.18.0


            1.18.1


            1.19.0


            1.19.1


            1.2.0


            1.20.0


            1.20.1


            1.3.0


            1.4.0


            1.4.1


            1.4.2


            1.4.3


            1.4.4


            1.4.5


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.4


            1.6.0


            1.6.1


            1.6.2


            1.7.0


            1.7.1


            1.8.0


            1.8.1


            1.8.2


            1.9.0


            1.9.1


            1.9.2


            1.9.3


            2.0.0


            2.0.0-alpha.0


            2.0.1


            2.0.2


            2.1.0


            2.1.1


            2.2.0


            2.2.1


            2.2.4


            2.2.5


            2.2.6


            2.2.7


            2.3.0


            2.3.1


            2.3.2


            2.3.3


            2.3.4


            2.3.5


            2.4.0


            2.4.1


            2.4.2


            2.4.3


            2.4.4


            2.4.5


            2.4.6


            v2.2.2


            v2.2.3


            v2.5.0

Fixed in


          2.5.1

References

Updated Mar 31, 2026 · Source: OSV.dev

Jan 07, 2019

1.16.0 minor

1 CVE

GHSA-3h6j-9x8m-rg3g Mar 31, 2026

Graby has stored XSS via iframe srcdoc Attribute in htmLawed Sanitization Config

Low

Network Low None

Summary

Graby's cleanupXss() function configures htmLawed with conflicting settings: safe=1 (which removes <iframe>) combined with 'elements' => '*+iframe-meta' (which re-enables <iframe>). htmLawed does not sanitize the srcdoc attribute, allowing injection of arbitrary JavaScript that executes when the content is rendered via |raw in templates.

Root Cause

src/Graby.php lines 1038-1048:

htmLawed($html, [
    'safe' => 1,                    // removes <iframe>
    'elements' => '*+iframe-meta',  // re-adds <iframe>, overrides safe=1
    'deny_attribute' => 'style',    // srcdoc is NOT denied
]);

The safe=1 and +iframe combination is a conflict: safe mode is designed to strip dangerous elements, but the elements override re-enables <iframe> without also blocking the dangerous srcdoc attribute.

Proof of Concept

Input to cleanupXss():

<iframe srcdoc="&lt;script&gt;alert(document.domain)&lt;/script&gt;"></iframe>

Output (unchanged — htmLawed passes it through):

<iframe srcdoc="&lt;script&gt;alert(document.domain)&lt;/script&gt;"></iframe>

When rendered via {{ content|raw }} in a template, srcdoc executes in an about:srcdoc frame with the same origin as the page. Confirmed via Puppeteer/Chromium headless: alert(document.domain) fires.

Validated on Wallabag (which uses Graby) via Docker: entry created via API with iframe-only content body triggers Readability failure → falls through to cleanupXss() path.

Impact

Stored XSS in any application rendering Graby-sanitized content via |raw
In Wallabag: affects both authenticated views and public share pages (unauthenticated)
No CSP headers in default Wallabag config — no secondary mitigation

Suggested Fix

Either remove +iframe from the elements config to keep iframes blocked:

'elements' => '*-iframe-meta',

Or explicitly deny the srcdoc attribute:

'deny_attribute' => 'style srcdoc',

Credit

Discovered by @tikket1, 2026-03-25. Redirected from wallabag/wallabag advisory by @j0k3r.

Affected versions


          1.0.0


          1.0.0-alpha.0


          1.0.0-alpha.1


          1.0.0-alpha.2


          1.0.1


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.0.6


          1.0.7


          1.0.8

+ 82 more


            1.1.0


            1.10.0


            1.10.1


            1.11.0


            1.11.1


            1.12.0


            1.12.1


            1.13.0


            1.13.1


            1.13.2


            1.13.3


            1.13.4


            1.13.5


            1.13.6


            1.14.0


            1.15.0


            1.15.1


            1.15.2


            1.15.3


            1.15.4


            1.15.5


            1.16.0


            1.17.0


            1.18.0


            1.18.1


            1.19.0


            1.19.1


            1.2.0


            1.20.0


            1.20.1


            1.3.0


            1.4.0


            1.4.1


            1.4.2


            1.4.3


            1.4.4


            1.4.5


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.4


            1.6.0


            1.6.1


            1.6.2


            1.7.0


            1.7.1


            1.8.0


            1.8.1


            1.8.2


            1.9.0


            1.9.1


            1.9.2


            1.9.3


            2.0.0


            2.0.0-alpha.0


            2.0.1


            2.0.2


            2.1.0


            2.1.1


            2.2.0


            2.2.1


            2.2.4


            2.2.5


            2.2.6


            2.2.7


            2.3.0


            2.3.1


            2.3.2


            2.3.3


            2.3.4


            2.3.5


            2.4.0


            2.4.1


            2.4.2


            2.4.3


            2.4.4


            2.4.5


            2.4.6


            v2.2.2


            v2.2.3


            v2.5.0

Fixed in


          2.5.1

References

Updated Mar 31, 2026 · Source: OSV.dev

Jan 04, 2019

1.15.5 patch

1 CVE

GHSA-3h6j-9x8m-rg3g Mar 31, 2026

Graby has stored XSS via iframe srcdoc Attribute in htmLawed Sanitization Config

Low

Network Low None

Summary

Graby's cleanupXss() function configures htmLawed with conflicting settings: safe=1 (which removes <iframe>) combined with 'elements' => '*+iframe-meta' (which re-enables <iframe>). htmLawed does not sanitize the srcdoc attribute, allowing injection of arbitrary JavaScript that executes when the content is rendered via |raw in templates.

Root Cause

src/Graby.php lines 1038-1048:

htmLawed($html, [
    'safe' => 1,                    // removes <iframe>
    'elements' => '*+iframe-meta',  // re-adds <iframe>, overrides safe=1
    'deny_attribute' => 'style',    // srcdoc is NOT denied
]);

The safe=1 and +iframe combination is a conflict: safe mode is designed to strip dangerous elements, but the elements override re-enables <iframe> without also blocking the dangerous srcdoc attribute.

Proof of Concept

Input to cleanupXss():

<iframe srcdoc="&lt;script&gt;alert(document.domain)&lt;/script&gt;"></iframe>

Output (unchanged — htmLawed passes it through):

<iframe srcdoc="&lt;script&gt;alert(document.domain)&lt;/script&gt;"></iframe>

When rendered via {{ content|raw }} in a template, srcdoc executes in an about:srcdoc frame with the same origin as the page. Confirmed via Puppeteer/Chromium headless: alert(document.domain) fires.

Validated on Wallabag (which uses Graby) via Docker: entry created via API with iframe-only content body triggers Readability failure → falls through to cleanupXss() path.

Impact

Stored XSS in any application rendering Graby-sanitized content via |raw
In Wallabag: affects both authenticated views and public share pages (unauthenticated)
No CSP headers in default Wallabag config — no secondary mitigation

Suggested Fix

Either remove +iframe from the elements config to keep iframes blocked:

'elements' => '*-iframe-meta',

Or explicitly deny the srcdoc attribute:

'deny_attribute' => 'style srcdoc',

Credit

Discovered by @tikket1, 2026-03-25. Redirected from wallabag/wallabag advisory by @j0k3r.

Affected versions


          1.0.0


          1.0.0-alpha.0


          1.0.0-alpha.1


          1.0.0-alpha.2


          1.0.1


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.0.6


          1.0.7


          1.0.8

+ 82 more


            1.1.0


            1.10.0


            1.10.1


            1.11.0


            1.11.1


            1.12.0


            1.12.1


            1.13.0


            1.13.1


            1.13.2


            1.13.3


            1.13.4


            1.13.5


            1.13.6


            1.14.0


            1.15.0


            1.15.1


            1.15.2


            1.15.3


            1.15.4


            1.15.5


            1.16.0


            1.17.0


            1.18.0


            1.18.1


            1.19.0


            1.19.1


            1.2.0


            1.20.0


            1.20.1


            1.3.0


            1.4.0


            1.4.1


            1.4.2


            1.4.3


            1.4.4


            1.4.5


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.4


            1.6.0


            1.6.1


            1.6.2


            1.7.0


            1.7.1


            1.8.0


            1.8.1


            1.8.2


            1.9.0


            1.9.1


            1.9.2


            1.9.3


            2.0.0


            2.0.0-alpha.0


            2.0.1


            2.0.2


            2.1.0


            2.1.1


            2.2.0


            2.2.1


            2.2.4


            2.2.5


            2.2.6


            2.2.7


            2.3.0


            2.3.1


            2.3.2


            2.3.3


            2.3.4


            2.3.5


            2.4.0


            2.4.1


            2.4.2


            2.4.3


            2.4.4


            2.4.5


            2.4.6


            v2.2.2


            v2.2.3


            v2.5.0

Fixed in


          2.5.1

References

Updated Mar 31, 2026 · Source: OSV.dev

Dec 04, 2018

1.15.4 patch

1 CVE

GHSA-3h6j-9x8m-rg3g Mar 31, 2026

Graby has stored XSS via iframe srcdoc Attribute in htmLawed Sanitization Config

Low

Network Low None

Summary

Graby's cleanupXss() function configures htmLawed with conflicting settings: safe=1 (which removes <iframe>) combined with 'elements' => '*+iframe-meta' (which re-enables <iframe>). htmLawed does not sanitize the srcdoc attribute, allowing injection of arbitrary JavaScript that executes when the content is rendered via |raw in templates.

Root Cause

src/Graby.php lines 1038-1048:

htmLawed($html, [
    'safe' => 1,                    // removes <iframe>
    'elements' => '*+iframe-meta',  // re-adds <iframe>, overrides safe=1
    'deny_attribute' => 'style',    // srcdoc is NOT denied
]);

The safe=1 and +iframe combination is a conflict: safe mode is designed to strip dangerous elements, but the elements override re-enables <iframe> without also blocking the dangerous srcdoc attribute.

Proof of Concept

Input to cleanupXss():

<iframe srcdoc="&lt;script&gt;alert(document.domain)&lt;/script&gt;"></iframe>

Output (unchanged — htmLawed passes it through):

<iframe srcdoc="&lt;script&gt;alert(document.domain)&lt;/script&gt;"></iframe>

When rendered via {{ content|raw }} in a template, srcdoc executes in an about:srcdoc frame with the same origin as the page. Confirmed via Puppeteer/Chromium headless: alert(document.domain) fires.

Validated on Wallabag (which uses Graby) via Docker: entry created via API with iframe-only content body triggers Readability failure → falls through to cleanupXss() path.

Impact

Stored XSS in any application rendering Graby-sanitized content via |raw
In Wallabag: affects both authenticated views and public share pages (unauthenticated)
No CSP headers in default Wallabag config — no secondary mitigation

Suggested Fix

Either remove +iframe from the elements config to keep iframes blocked:

'elements' => '*-iframe-meta',

Or explicitly deny the srcdoc attribute:

'deny_attribute' => 'style srcdoc',

Credit

Discovered by @tikket1, 2026-03-25. Redirected from wallabag/wallabag advisory by @j0k3r.

Affected versions


          1.0.0


          1.0.0-alpha.0


          1.0.0-alpha.1


          1.0.0-alpha.2


          1.0.1


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.0.6


          1.0.7


          1.0.8

+ 82 more


            1.1.0


            1.10.0


            1.10.1


            1.11.0


            1.11.1


            1.12.0


            1.12.1


            1.13.0


            1.13.1


            1.13.2


            1.13.3


            1.13.4


            1.13.5


            1.13.6


            1.14.0


            1.15.0


            1.15.1


            1.15.2


            1.15.3


            1.15.4


            1.15.5


            1.16.0


            1.17.0


            1.18.0


            1.18.1


            1.19.0


            1.19.1


            1.2.0


            1.20.0


            1.20.1


            1.3.0


            1.4.0


            1.4.1


            1.4.2


            1.4.3


            1.4.4


            1.4.5


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.4


            1.6.0


            1.6.1


            1.6.2


            1.7.0


            1.7.1


            1.8.0


            1.8.1


            1.8.2


            1.9.0


            1.9.1


            1.9.2


            1.9.3


            2.0.0


            2.0.0-alpha.0


            2.0.1


            2.0.2


            2.1.0


            2.1.1


            2.2.0


            2.2.1


            2.2.4


            2.2.5


            2.2.6


            2.2.7


            2.3.0


            2.3.1


            2.3.2


            2.3.3


            2.3.4


            2.3.5


            2.4.0


            2.4.1


            2.4.2


            2.4.3


            2.4.4


            2.4.5


            2.4.6


            v2.2.2


            v2.2.3


            v2.5.0

Fixed in


          2.5.1

References

Updated Mar 31, 2026 · Source: OSV.dev

Nov 07, 2018

1.15.3 patch

1 CVE

GHSA-3h6j-9x8m-rg3g Mar 31, 2026

Graby has stored XSS via iframe srcdoc Attribute in htmLawed Sanitization Config

Low

Network Low None

Summary

Graby's cleanupXss() function configures htmLawed with conflicting settings: safe=1 (which removes <iframe>) combined with 'elements' => '*+iframe-meta' (which re-enables <iframe>). htmLawed does not sanitize the srcdoc attribute, allowing injection of arbitrary JavaScript that executes when the content is rendered via |raw in templates.

Root Cause

src/Graby.php lines 1038-1048:

htmLawed($html, [
    'safe' => 1,                    // removes <iframe>
    'elements' => '*+iframe-meta',  // re-adds <iframe>, overrides safe=1
    'deny_attribute' => 'style',    // srcdoc is NOT denied
]);

The safe=1 and +iframe combination is a conflict: safe mode is designed to strip dangerous elements, but the elements override re-enables <iframe> without also blocking the dangerous srcdoc attribute.

Proof of Concept

Input to cleanupXss():

<iframe srcdoc="&lt;script&gt;alert(document.domain)&lt;/script&gt;"></iframe>

Output (unchanged — htmLawed passes it through):

<iframe srcdoc="&lt;script&gt;alert(document.domain)&lt;/script&gt;"></iframe>

When rendered via {{ content|raw }} in a template, srcdoc executes in an about:srcdoc frame with the same origin as the page. Confirmed via Puppeteer/Chromium headless: alert(document.domain) fires.

Validated on Wallabag (which uses Graby) via Docker: entry created via API with iframe-only content body triggers Readability failure → falls through to cleanupXss() path.

Impact

Stored XSS in any application rendering Graby-sanitized content via |raw
In Wallabag: affects both authenticated views and public share pages (unauthenticated)
No CSP headers in default Wallabag config — no secondary mitigation

Suggested Fix

Either remove +iframe from the elements config to keep iframes blocked:

'elements' => '*-iframe-meta',

Or explicitly deny the srcdoc attribute:

'deny_attribute' => 'style srcdoc',

Credit

Discovered by @tikket1, 2026-03-25. Redirected from wallabag/wallabag advisory by @j0k3r.

Affected versions


          1.0.0


          1.0.0-alpha.0


          1.0.0-alpha.1


          1.0.0-alpha.2


          1.0.1


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.0.6


          1.0.7


          1.0.8

+ 82 more


            1.1.0


            1.10.0


            1.10.1


            1.11.0


            1.11.1


            1.12.0


            1.12.1


            1.13.0


            1.13.1


            1.13.2


            1.13.3


            1.13.4


            1.13.5


            1.13.6


            1.14.0


            1.15.0


            1.15.1


            1.15.2


            1.15.3


            1.15.4


            1.15.5


            1.16.0


            1.17.0


            1.18.0


            1.18.1


            1.19.0


            1.19.1


            1.2.0


            1.20.0


            1.20.1


            1.3.0


            1.4.0


            1.4.1


            1.4.2


            1.4.3


            1.4.4


            1.4.5


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.4


            1.6.0


            1.6.1


            1.6.2


            1.7.0


            1.7.1


            1.8.0


            1.8.1


            1.8.2


            1.9.0


            1.9.1


            1.9.2


            1.9.3


            2.0.0


            2.0.0-alpha.0


            2.0.1


            2.0.2


            2.1.0


            2.1.1


            2.2.0


            2.2.1


            2.2.4


            2.2.5


            2.2.6


            2.2.7


            2.3.0


            2.3.1


            2.3.2


            2.3.3


            2.3.4


            2.3.5


            2.4.0


            2.4.1


            2.4.2


            2.4.3


            2.4.4


            2.4.5


            2.4.6


            v2.2.2


            v2.2.3


            v2.5.0

Fixed in


          2.5.1

References

Updated Mar 31, 2026 · Source: OSV.dev

Nov 01, 2018

1.15.2 patch

1 CVE

GHSA-3h6j-9x8m-rg3g Mar 31, 2026

Graby has stored XSS via iframe srcdoc Attribute in htmLawed Sanitization Config

Low

Network Low None

Summary

Graby's cleanupXss() function configures htmLawed with conflicting settings: safe=1 (which removes <iframe>) combined with 'elements' => '*+iframe-meta' (which re-enables <iframe>). htmLawed does not sanitize the srcdoc attribute, allowing injection of arbitrary JavaScript that executes when the content is rendered via |raw in templates.

Root Cause

src/Graby.php lines 1038-1048:

htmLawed($html, [
    'safe' => 1,                    // removes <iframe>
    'elements' => '*+iframe-meta',  // re-adds <iframe>, overrides safe=1
    'deny_attribute' => 'style',    // srcdoc is NOT denied
]);

The safe=1 and +iframe combination is a conflict: safe mode is designed to strip dangerous elements, but the elements override re-enables <iframe> without also blocking the dangerous srcdoc attribute.

Proof of Concept

Input to cleanupXss():

<iframe srcdoc="&lt;script&gt;alert(document.domain)&lt;/script&gt;"></iframe>

Output (unchanged — htmLawed passes it through):

<iframe srcdoc="&lt;script&gt;alert(document.domain)&lt;/script&gt;"></iframe>

When rendered via {{ content|raw }} in a template, srcdoc executes in an about:srcdoc frame with the same origin as the page. Confirmed via Puppeteer/Chromium headless: alert(document.domain) fires.

Validated on Wallabag (which uses Graby) via Docker: entry created via API with iframe-only content body triggers Readability failure → falls through to cleanupXss() path.

Impact

Stored XSS in any application rendering Graby-sanitized content via |raw
In Wallabag: affects both authenticated views and public share pages (unauthenticated)
No CSP headers in default Wallabag config — no secondary mitigation

Suggested Fix

Either remove +iframe from the elements config to keep iframes blocked:

'elements' => '*-iframe-meta',

Or explicitly deny the srcdoc attribute:

'deny_attribute' => 'style srcdoc',

Credit

Discovered by @tikket1, 2026-03-25. Redirected from wallabag/wallabag advisory by @j0k3r.

Affected versions


          1.0.0


          1.0.0-alpha.0


          1.0.0-alpha.1


          1.0.0-alpha.2


          1.0.1


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.0.6


          1.0.7


          1.0.8

+ 82 more


            1.1.0


            1.10.0


            1.10.1


            1.11.0


            1.11.1


            1.12.0


            1.12.1


            1.13.0


            1.13.1


            1.13.2


            1.13.3


            1.13.4


            1.13.5


            1.13.6


            1.14.0


            1.15.0


            1.15.1


            1.15.2


            1.15.3


            1.15.4


            1.15.5


            1.16.0


            1.17.0


            1.18.0


            1.18.1


            1.19.0


            1.19.1


            1.2.0


            1.20.0


            1.20.1


            1.3.0


            1.4.0


            1.4.1


            1.4.2


            1.4.3


            1.4.4


            1.4.5


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.4


            1.6.0


            1.6.1


            1.6.2


            1.7.0


            1.7.1


            1.8.0


            1.8.1


            1.8.2


            1.9.0


            1.9.1


            1.9.2


            1.9.3


            2.0.0


            2.0.0-alpha.0


            2.0.1


            2.0.2


            2.1.0


            2.1.1


            2.2.0


            2.2.1


            2.2.4


            2.2.5


            2.2.6


            2.2.7


            2.3.0


            2.3.1


            2.3.2


            2.3.3


            2.3.4


            2.3.5


            2.4.0


            2.4.1


            2.4.2


            2.4.3


            2.4.4


            2.4.5


            2.4.6


            v2.2.2


            v2.2.3


            v2.5.0

Fixed in


          2.5.1

References

Updated Mar 31, 2026 · Source: OSV.dev

Nov 01, 2018

1.15.1 patch

1 CVE

GHSA-3h6j-9x8m-rg3g Mar 31, 2026

Graby has stored XSS via iframe srcdoc Attribute in htmLawed Sanitization Config

Low

Network Low None

Summary

Graby's cleanupXss() function configures htmLawed with conflicting settings: safe=1 (which removes <iframe>) combined with 'elements' => '*+iframe-meta' (which re-enables <iframe>). htmLawed does not sanitize the srcdoc attribute, allowing injection of arbitrary JavaScript that executes when the content is rendered via |raw in templates.

Root Cause

src/Graby.php lines 1038-1048:

htmLawed($html, [
    'safe' => 1,                    // removes <iframe>
    'elements' => '*+iframe-meta',  // re-adds <iframe>, overrides safe=1
    'deny_attribute' => 'style',    // srcdoc is NOT denied
]);

The safe=1 and +iframe combination is a conflict: safe mode is designed to strip dangerous elements, but the elements override re-enables <iframe> without also blocking the dangerous srcdoc attribute.

Proof of Concept

Input to cleanupXss():

<iframe srcdoc="&lt;script&gt;alert(document.domain)&lt;/script&gt;"></iframe>

Output (unchanged — htmLawed passes it through):

<iframe srcdoc="&lt;script&gt;alert(document.domain)&lt;/script&gt;"></iframe>

When rendered via {{ content|raw }} in a template, srcdoc executes in an about:srcdoc frame with the same origin as the page. Confirmed via Puppeteer/Chromium headless: alert(document.domain) fires.

Validated on Wallabag (which uses Graby) via Docker: entry created via API with iframe-only content body triggers Readability failure → falls through to cleanupXss() path.

Impact

Stored XSS in any application rendering Graby-sanitized content via |raw
In Wallabag: affects both authenticated views and public share pages (unauthenticated)
No CSP headers in default Wallabag config — no secondary mitigation

Suggested Fix

Either remove +iframe from the elements config to keep iframes blocked:

'elements' => '*-iframe-meta',

Or explicitly deny the srcdoc attribute:

'deny_attribute' => 'style srcdoc',

Credit

Discovered by @tikket1, 2026-03-25. Redirected from wallabag/wallabag advisory by @j0k3r.

Affected versions


          1.0.0


          1.0.0-alpha.0


          1.0.0-alpha.1


          1.0.0-alpha.2


          1.0.1


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.0.6


          1.0.7


          1.0.8

+ 82 more


            1.1.0


            1.10.0


            1.10.1


            1.11.0


            1.11.1


            1.12.0


            1.12.1


            1.13.0


            1.13.1


            1.13.2


            1.13.3


            1.13.4


            1.13.5


            1.13.6


            1.14.0


            1.15.0


            1.15.1


            1.15.2


            1.15.3


            1.15.4


            1.15.5


            1.16.0


            1.17.0


            1.18.0


            1.18.1


            1.19.0


            1.19.1


            1.2.0


            1.20.0


            1.20.1


            1.3.0


            1.4.0


            1.4.1


            1.4.2


            1.4.3


            1.4.4


            1.4.5


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.4


            1.6.0


            1.6.1


            1.6.2


            1.7.0


            1.7.1


            1.8.0


            1.8.1


            1.8.2


            1.9.0


            1.9.1


            1.9.2


            1.9.3


            2.0.0


            2.0.0-alpha.0


            2.0.1


            2.0.2


            2.1.0


            2.1.1


            2.2.0


            2.2.1


            2.2.4


            2.2.5


            2.2.6


            2.2.7


            2.3.0


            2.3.1


            2.3.2


            2.3.3


            2.3.4


            2.3.5


            2.4.0


            2.4.1


            2.4.2


            2.4.3


            2.4.4


            2.4.5


            2.4.6


            v2.2.2


            v2.2.3


            v2.5.0

Fixed in


          2.5.1

References

Updated Mar 31, 2026 · Source: OSV.dev

Nov 01, 2018

1.15.0 minor

1 CVE

GHSA-3h6j-9x8m-rg3g Mar 31, 2026

Graby has stored XSS via iframe srcdoc Attribute in htmLawed Sanitization Config

Low

Network Low None

Summary

Graby's cleanupXss() function configures htmLawed with conflicting settings: safe=1 (which removes <iframe>) combined with 'elements' => '*+iframe-meta' (which re-enables <iframe>). htmLawed does not sanitize the srcdoc attribute, allowing injection of arbitrary JavaScript that executes when the content is rendered via |raw in templates.

Root Cause

src/Graby.php lines 1038-1048:

htmLawed($html, [
    'safe' => 1,                    // removes <iframe>
    'elements' => '*+iframe-meta',  // re-adds <iframe>, overrides safe=1
    'deny_attribute' => 'style',    // srcdoc is NOT denied
]);

The safe=1 and +iframe combination is a conflict: safe mode is designed to strip dangerous elements, but the elements override re-enables <iframe> without also blocking the dangerous srcdoc attribute.

Proof of Concept

Input to cleanupXss():

<iframe srcdoc="&lt;script&gt;alert(document.domain)&lt;/script&gt;"></iframe>

Output (unchanged — htmLawed passes it through):

<iframe srcdoc="&lt;script&gt;alert(document.domain)&lt;/script&gt;"></iframe>

When rendered via {{ content|raw }} in a template, srcdoc executes in an about:srcdoc frame with the same origin as the page. Confirmed via Puppeteer/Chromium headless: alert(document.domain) fires.

Validated on Wallabag (which uses Graby) via Docker: entry created via API with iframe-only content body triggers Readability failure → falls through to cleanupXss() path.

Impact

Stored XSS in any application rendering Graby-sanitized content via |raw
In Wallabag: affects both authenticated views and public share pages (unauthenticated)
No CSP headers in default Wallabag config — no secondary mitigation

Suggested Fix

Either remove +iframe from the elements config to keep iframes blocked:

'elements' => '*-iframe-meta',

Or explicitly deny the srcdoc attribute:

'deny_attribute' => 'style srcdoc',

Credit

Discovered by @tikket1, 2026-03-25. Redirected from wallabag/wallabag advisory by @j0k3r.

Affected versions


          1.0.0


          1.0.0-alpha.0


          1.0.0-alpha.1


          1.0.0-alpha.2


          1.0.1


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.0.6


          1.0.7


          1.0.8

+ 82 more


            1.1.0


            1.10.0


            1.10.1


            1.11.0


            1.11.1


            1.12.0


            1.12.1


            1.13.0


            1.13.1


            1.13.2


            1.13.3


            1.13.4


            1.13.5


            1.13.6


            1.14.0


            1.15.0


            1.15.1


            1.15.2


            1.15.3


            1.15.4


            1.15.5


            1.16.0


            1.17.0


            1.18.0


            1.18.1


            1.19.0


            1.19.1


            1.2.0


            1.20.0


            1.20.1


            1.3.0


            1.4.0


            1.4.1


            1.4.2


            1.4.3


            1.4.4


            1.4.5


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.4


            1.6.0


            1.6.1


            1.6.2


            1.7.0


            1.7.1


            1.8.0


            1.8.1


            1.8.2


            1.9.0


            1.9.1


            1.9.2


            1.9.3


            2.0.0


            2.0.0-alpha.0


            2.0.1


            2.0.2


            2.1.0


            2.1.1


            2.2.0


            2.2.1


            2.2.4


            2.2.5


            2.2.6


            2.2.7


            2.3.0


            2.3.1


            2.3.2


            2.3.3


            2.3.4


            2.3.5


            2.4.0


            2.4.1


            2.4.2


            2.4.3


            2.4.4


            2.4.5


            2.4.6


            v2.2.2


            v2.2.3


            v2.5.0

Fixed in


          2.5.1

References

Updated Mar 31, 2026 · Source: OSV.dev

Oct 29, 2018

1.14.0 minor

1 CVE

GHSA-3h6j-9x8m-rg3g Mar 31, 2026

Graby has stored XSS via iframe srcdoc Attribute in htmLawed Sanitization Config

Low

Network Low None

Summary

Graby's cleanupXss() function configures htmLawed with conflicting settings: safe=1 (which removes <iframe>) combined with 'elements' => '*+iframe-meta' (which re-enables <iframe>). htmLawed does not sanitize the srcdoc attribute, allowing injection of arbitrary JavaScript that executes when the content is rendered via |raw in templates.

Root Cause

src/Graby.php lines 1038-1048:

htmLawed($html, [
    'safe' => 1,                    // removes <iframe>
    'elements' => '*+iframe-meta',  // re-adds <iframe>, overrides safe=1
    'deny_attribute' => 'style',    // srcdoc is NOT denied
]);

The safe=1 and +iframe combination is a conflict: safe mode is designed to strip dangerous elements, but the elements override re-enables <iframe> without also blocking the dangerous srcdoc attribute.

Proof of Concept

Input to cleanupXss():

<iframe srcdoc="&lt;script&gt;alert(document.domain)&lt;/script&gt;"></iframe>

Output (unchanged — htmLawed passes it through):

<iframe srcdoc="&lt;script&gt;alert(document.domain)&lt;/script&gt;"></iframe>

When rendered via {{ content|raw }} in a template, srcdoc executes in an about:srcdoc frame with the same origin as the page. Confirmed via Puppeteer/Chromium headless: alert(document.domain) fires.

Validated on Wallabag (which uses Graby) via Docker: entry created via API with iframe-only content body triggers Readability failure → falls through to cleanupXss() path.

Impact

Stored XSS in any application rendering Graby-sanitized content via |raw
In Wallabag: affects both authenticated views and public share pages (unauthenticated)
No CSP headers in default Wallabag config — no secondary mitigation

Suggested Fix

Either remove +iframe from the elements config to keep iframes blocked:

'elements' => '*-iframe-meta',

Or explicitly deny the srcdoc attribute:

'deny_attribute' => 'style srcdoc',

Credit

Discovered by @tikket1, 2026-03-25. Redirected from wallabag/wallabag advisory by @j0k3r.

Affected versions


          1.0.0


          1.0.0-alpha.0


          1.0.0-alpha.1


          1.0.0-alpha.2


          1.0.1


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.0.6


          1.0.7


          1.0.8

+ 82 more


            1.1.0


            1.10.0


            1.10.1


            1.11.0


            1.11.1


            1.12.0


            1.12.1


            1.13.0


            1.13.1


            1.13.2


            1.13.3


            1.13.4


            1.13.5


            1.13.6


            1.14.0


            1.15.0


            1.15.1


            1.15.2


            1.15.3


            1.15.4


            1.15.5


            1.16.0


            1.17.0


            1.18.0


            1.18.1


            1.19.0


            1.19.1


            1.2.0


            1.20.0


            1.20.1


            1.3.0


            1.4.0


            1.4.1


            1.4.2


            1.4.3


            1.4.4


            1.4.5


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.4


            1.6.0


            1.6.1


            1.6.2


            1.7.0


            1.7.1


            1.8.0


            1.8.1


            1.8.2


            1.9.0


            1.9.1


            1.9.2


            1.9.3


            2.0.0


            2.0.0-alpha.0


            2.0.1


            2.0.2


            2.1.0


            2.1.1


            2.2.0


            2.2.1


            2.2.4


            2.2.5


            2.2.6


            2.2.7


            2.3.0


            2.3.1


            2.3.2


            2.3.3


            2.3.4


            2.3.5


            2.4.0


            2.4.1


            2.4.2


            2.4.3


            2.4.4


            2.4.5


            2.4.6


            v2.2.2


            v2.2.3


            v2.5.0

Fixed in


          2.5.1

References

Updated Mar 31, 2026 · Source: OSV.dev

Oct 01, 2018

1.13.6 patch

1 CVE

GHSA-3h6j-9x8m-rg3g Mar 31, 2026

Graby has stored XSS via iframe srcdoc Attribute in htmLawed Sanitization Config

Low

Network Low None

Summary

Graby's cleanupXss() function configures htmLawed with conflicting settings: safe=1 (which removes <iframe>) combined with 'elements' => '*+iframe-meta' (which re-enables <iframe>). htmLawed does not sanitize the srcdoc attribute, allowing injection of arbitrary JavaScript that executes when the content is rendered via |raw in templates.

Root Cause

src/Graby.php lines 1038-1048:

htmLawed($html, [
    'safe' => 1,                    // removes <iframe>
    'elements' => '*+iframe-meta',  // re-adds <iframe>, overrides safe=1
    'deny_attribute' => 'style',    // srcdoc is NOT denied
]);

The safe=1 and +iframe combination is a conflict: safe mode is designed to strip dangerous elements, but the elements override re-enables <iframe> without also blocking the dangerous srcdoc attribute.

Proof of Concept

Input to cleanupXss():

<iframe srcdoc="&lt;script&gt;alert(document.domain)&lt;/script&gt;"></iframe>

Output (unchanged — htmLawed passes it through):

<iframe srcdoc="&lt;script&gt;alert(document.domain)&lt;/script&gt;"></iframe>

When rendered via {{ content|raw }} in a template, srcdoc executes in an about:srcdoc frame with the same origin as the page. Confirmed via Puppeteer/Chromium headless: alert(document.domain) fires.

Validated on Wallabag (which uses Graby) via Docker: entry created via API with iframe-only content body triggers Readability failure → falls through to cleanupXss() path.

Impact

Stored XSS in any application rendering Graby-sanitized content via |raw
In Wallabag: affects both authenticated views and public share pages (unauthenticated)
No CSP headers in default Wallabag config — no secondary mitigation

Suggested Fix

Either remove +iframe from the elements config to keep iframes blocked:

'elements' => '*-iframe-meta',

Or explicitly deny the srcdoc attribute:

'deny_attribute' => 'style srcdoc',

Credit

Discovered by @tikket1, 2026-03-25. Redirected from wallabag/wallabag advisory by @j0k3r.

Affected versions


          1.0.0


          1.0.0-alpha.0


          1.0.0-alpha.1


          1.0.0-alpha.2


          1.0.1


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.0.6


          1.0.7


          1.0.8

+ 82 more


            1.1.0


            1.10.0


            1.10.1


            1.11.0


            1.11.1


            1.12.0


            1.12.1


            1.13.0


            1.13.1


            1.13.2


            1.13.3


            1.13.4


            1.13.5


            1.13.6


            1.14.0


            1.15.0


            1.15.1


            1.15.2


            1.15.3


            1.15.4


            1.15.5


            1.16.0


            1.17.0


            1.18.0


            1.18.1


            1.19.0


            1.19.1


            1.2.0


            1.20.0


            1.20.1


            1.3.0


            1.4.0


            1.4.1


            1.4.2


            1.4.3


            1.4.4


            1.4.5


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.4


            1.6.0


            1.6.1


            1.6.2


            1.7.0


            1.7.1


            1.8.0


            1.8.1


            1.8.2


            1.9.0


            1.9.1


            1.9.2


            1.9.3


            2.0.0


            2.0.0-alpha.0


            2.0.1


            2.0.2


            2.1.0


            2.1.1


            2.2.0


            2.2.1


            2.2.4


            2.2.5


            2.2.6


            2.2.7


            2.3.0


            2.3.1


            2.3.2


            2.3.3


            2.3.4


            2.3.5


            2.4.0


            2.4.1


            2.4.2


            2.4.3


            2.4.4


            2.4.5


            2.4.6


            v2.2.2


            v2.2.3


            v2.5.0

Fixed in


          2.5.1

References

Updated Mar 31, 2026 · Source: OSV.dev

Aug 31, 2018

1.13.5 patch

1 CVE

GHSA-3h6j-9x8m-rg3g Mar 31, 2026

Graby has stored XSS via iframe srcdoc Attribute in htmLawed Sanitization Config

Low

Network Low None

Summary

Graby's cleanupXss() function configures htmLawed with conflicting settings: safe=1 (which removes <iframe>) combined with 'elements' => '*+iframe-meta' (which re-enables <iframe>). htmLawed does not sanitize the srcdoc attribute, allowing injection of arbitrary JavaScript that executes when the content is rendered via |raw in templates.

Root Cause

src/Graby.php lines 1038-1048:

htmLawed($html, [
    'safe' => 1,                    // removes <iframe>
    'elements' => '*+iframe-meta',  // re-adds <iframe>, overrides safe=1
    'deny_attribute' => 'style',    // srcdoc is NOT denied
]);

The safe=1 and +iframe combination is a conflict: safe mode is designed to strip dangerous elements, but the elements override re-enables <iframe> without also blocking the dangerous srcdoc attribute.

Proof of Concept

Input to cleanupXss():

<iframe srcdoc="&lt;script&gt;alert(document.domain)&lt;/script&gt;"></iframe>

Output (unchanged — htmLawed passes it through):

<iframe srcdoc="&lt;script&gt;alert(document.domain)&lt;/script&gt;"></iframe>

When rendered via {{ content|raw }} in a template, srcdoc executes in an about:srcdoc frame with the same origin as the page. Confirmed via Puppeteer/Chromium headless: alert(document.domain) fires.

Validated on Wallabag (which uses Graby) via Docker: entry created via API with iframe-only content body triggers Readability failure → falls through to cleanupXss() path.

Impact

Stored XSS in any application rendering Graby-sanitized content via |raw
In Wallabag: affects both authenticated views and public share pages (unauthenticated)
No CSP headers in default Wallabag config — no secondary mitigation

Suggested Fix

Either remove +iframe from the elements config to keep iframes blocked:

'elements' => '*-iframe-meta',

Or explicitly deny the srcdoc attribute:

'deny_attribute' => 'style srcdoc',

Credit

Discovered by @tikket1, 2026-03-25. Redirected from wallabag/wallabag advisory by @j0k3r.

Affected versions


          1.0.0


          1.0.0-alpha.0


          1.0.0-alpha.1


          1.0.0-alpha.2


          1.0.1


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.0.6


          1.0.7


          1.0.8

+ 82 more


            1.1.0


            1.10.0


            1.10.1


            1.11.0


            1.11.1


            1.12.0


            1.12.1


            1.13.0


            1.13.1


            1.13.2


            1.13.3


            1.13.4


            1.13.5


            1.13.6


            1.14.0


            1.15.0


            1.15.1


            1.15.2


            1.15.3


            1.15.4


            1.15.5


            1.16.0


            1.17.0


            1.18.0


            1.18.1


            1.19.0


            1.19.1


            1.2.0


            1.20.0


            1.20.1


            1.3.0


            1.4.0


            1.4.1


            1.4.2


            1.4.3


            1.4.4


            1.4.5


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.4


            1.6.0


            1.6.1


            1.6.2


            1.7.0


            1.7.1


            1.8.0


            1.8.1


            1.8.2


            1.9.0


            1.9.1


            1.9.2


            1.9.3


            2.0.0


            2.0.0-alpha.0


            2.0.1


            2.0.2


            2.1.0


            2.1.1


            2.2.0


            2.2.1


            2.2.4


            2.2.5


            2.2.6


            2.2.7


            2.3.0


            2.3.1


            2.3.2


            2.3.3


            2.3.4


            2.3.5


            2.4.0


            2.4.1


            2.4.2


            2.4.3


            2.4.4


            2.4.5


            2.4.6


            v2.2.2


            v2.2.3


            v2.5.0

Fixed in


          2.5.1

References

Updated Mar 31, 2026 · Source: OSV.dev

Jul 28, 2018

1.13.4 patch

1 CVE

GHSA-3h6j-9x8m-rg3g Mar 31, 2026

Graby has stored XSS via iframe srcdoc Attribute in htmLawed Sanitization Config

Low

Network Low None

Summary

Graby's cleanupXss() function configures htmLawed with conflicting settings: safe=1 (which removes <iframe>) combined with 'elements' => '*+iframe-meta' (which re-enables <iframe>). htmLawed does not sanitize the srcdoc attribute, allowing injection of arbitrary JavaScript that executes when the content is rendered via |raw in templates.

Root Cause

src/Graby.php lines 1038-1048:

htmLawed($html, [
    'safe' => 1,                    // removes <iframe>
    'elements' => '*+iframe-meta',  // re-adds <iframe>, overrides safe=1
    'deny_attribute' => 'style',    // srcdoc is NOT denied
]);

The safe=1 and +iframe combination is a conflict: safe mode is designed to strip dangerous elements, but the elements override re-enables <iframe> without also blocking the dangerous srcdoc attribute.

Proof of Concept

Input to cleanupXss():

<iframe srcdoc="&lt;script&gt;alert(document.domain)&lt;/script&gt;"></iframe>

Output (unchanged — htmLawed passes it through):

<iframe srcdoc="&lt;script&gt;alert(document.domain)&lt;/script&gt;"></iframe>

When rendered via {{ content|raw }} in a template, srcdoc executes in an about:srcdoc frame with the same origin as the page. Confirmed via Puppeteer/Chromium headless: alert(document.domain) fires.

Validated on Wallabag (which uses Graby) via Docker: entry created via API with iframe-only content body triggers Readability failure → falls through to cleanupXss() path.

Impact

Stored XSS in any application rendering Graby-sanitized content via |raw
In Wallabag: affects both authenticated views and public share pages (unauthenticated)
No CSP headers in default Wallabag config — no secondary mitigation

Suggested Fix

Either remove +iframe from the elements config to keep iframes blocked:

'elements' => '*-iframe-meta',

Or explicitly deny the srcdoc attribute:

'deny_attribute' => 'style srcdoc',

Credit

Discovered by @tikket1, 2026-03-25. Redirected from wallabag/wallabag advisory by @j0k3r.

Affected versions


          1.0.0


          1.0.0-alpha.0


          1.0.0-alpha.1


          1.0.0-alpha.2


          1.0.1


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.0.6


          1.0.7


          1.0.8

+ 82 more


            1.1.0


            1.10.0


            1.10.1


            1.11.0


            1.11.1


            1.12.0


            1.12.1


            1.13.0


            1.13.1


            1.13.2


            1.13.3


            1.13.4


            1.13.5


            1.13.6


            1.14.0


            1.15.0


            1.15.1


            1.15.2


            1.15.3


            1.15.4


            1.15.5


            1.16.0


            1.17.0


            1.18.0


            1.18.1


            1.19.0


            1.19.1


            1.2.0


            1.20.0


            1.20.1


            1.3.0


            1.4.0


            1.4.1


            1.4.2


            1.4.3


            1.4.4


            1.4.5


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.4


            1.6.0


            1.6.1


            1.6.2


            1.7.0


            1.7.1


            1.8.0


            1.8.1


            1.8.2


            1.9.0


            1.9.1


            1.9.2


            1.9.3


            2.0.0


            2.0.0-alpha.0


            2.0.1


            2.0.2


            2.1.0


            2.1.1


            2.2.0


            2.2.1


            2.2.4


            2.2.5


            2.2.6


            2.2.7


            2.3.0


            2.3.1


            2.3.2


            2.3.3


            2.3.4


            2.3.5


            2.4.0


            2.4.1


            2.4.2


            2.4.3


            2.4.4


            2.4.5


            2.4.6


            v2.2.2


            v2.2.3


            v2.5.0

Fixed in


          2.5.1

References

Updated Mar 31, 2026 · Source: OSV.dev

Jun 11, 2018

1.13.3 patch

1 CVE

GHSA-3h6j-9x8m-rg3g Mar 31, 2026

Graby has stored XSS via iframe srcdoc Attribute in htmLawed Sanitization Config

Low

Network Low None

Summary

Graby's cleanupXss() function configures htmLawed with conflicting settings: safe=1 (which removes <iframe>) combined with 'elements' => '*+iframe-meta' (which re-enables <iframe>). htmLawed does not sanitize the srcdoc attribute, allowing injection of arbitrary JavaScript that executes when the content is rendered via |raw in templates.

Root Cause

src/Graby.php lines 1038-1048:

htmLawed($html, [
    'safe' => 1,                    // removes <iframe>
    'elements' => '*+iframe-meta',  // re-adds <iframe>, overrides safe=1
    'deny_attribute' => 'style',    // srcdoc is NOT denied
]);

The safe=1 and +iframe combination is a conflict: safe mode is designed to strip dangerous elements, but the elements override re-enables <iframe> without also blocking the dangerous srcdoc attribute.

Proof of Concept

Input to cleanupXss():

<iframe srcdoc="&lt;script&gt;alert(document.domain)&lt;/script&gt;"></iframe>

Output (unchanged — htmLawed passes it through):

<iframe srcdoc="&lt;script&gt;alert(document.domain)&lt;/script&gt;"></iframe>

When rendered via {{ content|raw }} in a template, srcdoc executes in an about:srcdoc frame with the same origin as the page. Confirmed via Puppeteer/Chromium headless: alert(document.domain) fires.

Validated on Wallabag (which uses Graby) via Docker: entry created via API with iframe-only content body triggers Readability failure → falls through to cleanupXss() path.

Impact

Stored XSS in any application rendering Graby-sanitized content via |raw
In Wallabag: affects both authenticated views and public share pages (unauthenticated)
No CSP headers in default Wallabag config — no secondary mitigation

Suggested Fix

Either remove +iframe from the elements config to keep iframes blocked:

'elements' => '*-iframe-meta',

Or explicitly deny the srcdoc attribute:

'deny_attribute' => 'style srcdoc',

Credit

Discovered by @tikket1, 2026-03-25. Redirected from wallabag/wallabag advisory by @j0k3r.

Affected versions


          1.0.0


          1.0.0-alpha.0


          1.0.0-alpha.1


          1.0.0-alpha.2


          1.0.1


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.0.6


          1.0.7


          1.0.8

+ 82 more


            1.1.0


            1.10.0


            1.10.1


            1.11.0


            1.11.1


            1.12.0


            1.12.1


            1.13.0


            1.13.1


            1.13.2


            1.13.3


            1.13.4


            1.13.5


            1.13.6


            1.14.0


            1.15.0


            1.15.1


            1.15.2


            1.15.3


            1.15.4


            1.15.5


            1.16.0


            1.17.0


            1.18.0


            1.18.1


            1.19.0


            1.19.1


            1.2.0


            1.20.0


            1.20.1


            1.3.0


            1.4.0


            1.4.1


            1.4.2


            1.4.3


            1.4.4


            1.4.5


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.4


            1.6.0


            1.6.1


            1.6.2


            1.7.0


            1.7.1


            1.8.0


            1.8.1


            1.8.2


            1.9.0


            1.9.1


            1.9.2


            1.9.3


            2.0.0


            2.0.0-alpha.0


            2.0.1


            2.0.2


            2.1.0


            2.1.1


            2.2.0


            2.2.1


            2.2.4


            2.2.5


            2.2.6


            2.2.7


            2.3.0


            2.3.1


            2.3.2


            2.3.3


            2.3.4


            2.3.5


            2.4.0


            2.4.1


            2.4.2


            2.4.3


            2.4.4


            2.4.5


            2.4.6


            v2.2.2


            v2.2.3


            v2.5.0

Fixed in


          2.5.1

References

Updated Mar 31, 2026 · Source: OSV.dev

Jun 08, 2018

1.13.2 patch

1 CVE

GHSA-3h6j-9x8m-rg3g Mar 31, 2026

Graby has stored XSS via iframe srcdoc Attribute in htmLawed Sanitization Config

Low

Network Low None

Summary

Graby's cleanupXss() function configures htmLawed with conflicting settings: safe=1 (which removes <iframe>) combined with 'elements' => '*+iframe-meta' (which re-enables <iframe>). htmLawed does not sanitize the srcdoc attribute, allowing injection of arbitrary JavaScript that executes when the content is rendered via |raw in templates.

Root Cause

src/Graby.php lines 1038-1048:

htmLawed($html, [
    'safe' => 1,                    // removes <iframe>
    'elements' => '*+iframe-meta',  // re-adds <iframe>, overrides safe=1
    'deny_attribute' => 'style',    // srcdoc is NOT denied
]);

The safe=1 and +iframe combination is a conflict: safe mode is designed to strip dangerous elements, but the elements override re-enables <iframe> without also blocking the dangerous srcdoc attribute.

Proof of Concept

Input to cleanupXss():

<iframe srcdoc="&lt;script&gt;alert(document.domain)&lt;/script&gt;"></iframe>

Output (unchanged — htmLawed passes it through):

<iframe srcdoc="&lt;script&gt;alert(document.domain)&lt;/script&gt;"></iframe>

When rendered via {{ content|raw }} in a template, srcdoc executes in an about:srcdoc frame with the same origin as the page. Confirmed via Puppeteer/Chromium headless: alert(document.domain) fires.

Validated on Wallabag (which uses Graby) via Docker: entry created via API with iframe-only content body triggers Readability failure → falls through to cleanupXss() path.

Impact

Stored XSS in any application rendering Graby-sanitized content via |raw
In Wallabag: affects both authenticated views and public share pages (unauthenticated)
No CSP headers in default Wallabag config — no secondary mitigation

Suggested Fix

Either remove +iframe from the elements config to keep iframes blocked:

'elements' => '*-iframe-meta',

Or explicitly deny the srcdoc attribute:

'deny_attribute' => 'style srcdoc',

Credit

Discovered by @tikket1, 2026-03-25. Redirected from wallabag/wallabag advisory by @j0k3r.

Affected versions


          1.0.0


          1.0.0-alpha.0


          1.0.0-alpha.1


          1.0.0-alpha.2


          1.0.1


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.0.6


          1.0.7


          1.0.8

+ 82 more


            1.1.0


            1.10.0


            1.10.1


            1.11.0


            1.11.1


            1.12.0


            1.12.1


            1.13.0


            1.13.1


            1.13.2


            1.13.3


            1.13.4


            1.13.5


            1.13.6


            1.14.0


            1.15.0


            1.15.1


            1.15.2


            1.15.3


            1.15.4


            1.15.5


            1.16.0


            1.17.0


            1.18.0


            1.18.1


            1.19.0


            1.19.1


            1.2.0


            1.20.0


            1.20.1


            1.3.0


            1.4.0


            1.4.1


            1.4.2


            1.4.3


            1.4.4


            1.4.5


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.4


            1.6.0


            1.6.1


            1.6.2


            1.7.0


            1.7.1


            1.8.0


            1.8.1


            1.8.2


            1.9.0


            1.9.1


            1.9.2


            1.9.3


            2.0.0


            2.0.0-alpha.0


            2.0.1


            2.0.2


            2.1.0


            2.1.1


            2.2.0


            2.2.1


            2.2.4


            2.2.5


            2.2.6


            2.2.7


            2.3.0


            2.3.1


            2.3.2


            2.3.3


            2.3.4


            2.3.5


            2.4.0


            2.4.1


            2.4.2


            2.4.3


            2.4.4


            2.4.5


            2.4.6


            v2.2.2


            v2.2.3


            v2.5.0

Fixed in


          2.5.1

References

Updated Mar 31, 2026 · Source: OSV.dev

Jun 06, 2018

Activity

Reach

Details