{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.5.0"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "j0k3r/graby"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.5.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-31T23:12:36Z",
    "nvd_published_at": null,
    "severity": "LOW"
  },
  "details": "## Summary\n\nGraby\u0027s `cleanupXss()` function configures htmLawed with conflicting settings: `safe=1` (which removes `\u003ciframe\u003e`) combined with `\u0027elements\u0027 =\u003e \u0027*+iframe-meta\u0027` (which re-enables `\u003ciframe\u003e`). htmLawed does not sanitize the `srcdoc` attribute, allowing injection of arbitrary JavaScript that executes when the content is rendered via `|raw` in templates.\n\n## Root Cause\n\n**`src/Graby.php` lines 1038-1048:**\n```php\nhtmLawed($html, [\n    \u0027safe\u0027 =\u003e 1,                    // removes \u003ciframe\u003e\n    \u0027elements\u0027 =\u003e \u0027*+iframe-meta\u0027,  // re-adds \u003ciframe\u003e, overrides safe=1\n    \u0027deny_attribute\u0027 =\u003e \u0027style\u0027,    // srcdoc is NOT denied\n]);\n```\n\nThe `safe=1` and `+iframe` combination is a conflict: `safe` mode is designed to strip dangerous elements, but the elements override re-enables `\u003ciframe\u003e` without also blocking the dangerous `srcdoc` attribute.\n\n## Proof of Concept\n\nInput to `cleanupXss()`:\n```html\n\u003ciframe srcdoc=\"\u0026lt;script\u0026gt;alert(document.domain)\u0026lt;/script\u0026gt;\"\u003e\u003c/iframe\u003e\n```\n\nOutput (unchanged \u2014 htmLawed passes it through):\n```html\n\u003ciframe srcdoc=\"\u0026lt;script\u0026gt;alert(document.domain)\u0026lt;/script\u0026gt;\"\u003e\u003c/iframe\u003e\n```\n\nWhen rendered via `{{ content|raw }}` in a template, `srcdoc` executes in an `about:srcdoc` frame with the same origin as the page. **Confirmed via Puppeteer/Chromium headless: `alert(document.domain)` fires.**\n\nValidated on Wallabag (which uses Graby) via Docker: entry created via API with iframe-only content body triggers Readability failure \u2192 falls through to `cleanupXss()` path.\n\n## Impact\n\n- Stored XSS in any application rendering Graby-sanitized content via `|raw`\n- In Wallabag: affects both authenticated views and public share pages (unauthenticated)\n- No CSP headers in default Wallabag config \u2014 no secondary mitigation\n\n## Suggested Fix\n\nEither remove `+iframe` from the elements config to keep iframes blocked:\n```php\n\u0027elements\u0027 =\u003e \u0027*-iframe-meta\u0027,\n```\n\nOr explicitly deny the `srcdoc` attribute:\n```php\n\u0027deny_attribute\u0027 =\u003e \u0027style srcdoc\u0027,\n```\n\n## Credit\n\nDiscovered by @tikket1, 2026-03-25. Redirected from wallabag/wallabag advisory by @j0k3r.",
  "id": "GHSA-3h6j-9x8m-rg3g",
  "modified": "2026-03-31T23:12:36Z",
  "published": "2026-03-31T23:12:36Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/j0k3r/graby/security/advisories/GHSA-3h6j-9x8m-rg3g"
    },
    {
      "type": "WEB",
      "url": "https://github.com/j0k3r/graby/commit/0295d828822f7a59c5751a8199973a4f965a99b0"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/j0k3r/graby"
    },
    {
      "type": "WEB",
      "url": "https://github.com/j0k3r/graby/releases/tag/2.5.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Graby has stored XSS via iframe srcdoc Attribute in htmLawed Sanitization Config"
}