CVE-2026-42841
published 2026-05-11CVE-2026-42841: Grav is a file-based Web platform. Prior to 2.0.0-beta.2, an authenticated user with page editing permissions can inject an executable JavaScript event-handler…
PriorityP425medium4.8CVSS 3.1
AVNACLPRHUIRSCCLILAN
EPSS
0.40%
31.5th percentile
Grav is a file-based Web platform. Prior to 2.0.0-beta.2, an authenticated user with page editing permissions can inject an executable JavaScript event-handler attribute into rendered image HTML through Grav's Markdown media action syntax. The issue is caused by Markdown image query parameters being converted into callable media actions. The public attribute() media method can be reached this way, allowing an editor to set an arbitrary HTML attribute name and value on the generated image element. This vulnerability is fixed in 2.0.0-beta.2.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| getgrav | grav | < 2.0.0-beta.2 | 2.0.0-beta.2 |
| getgrav | grav | <= 1.8.0 | — |
| getgrav | grav | — | — |
| getgrav | grav | >= 0 < 2.0.0-rc.9 | 2.0.0-rc.9 |
| getgrav | grav | >= 0 < 2.0.0-beta.2 | 2.0.0-beta.2 |
CVSS provenance
nvdv3.14.8MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
nvdv4.06.9MEDIUMCVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
ghsa4.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Grav: Stored CSS injection via Markdown image ?style=… reaches MediaObjectTrait::style() — incomplete patch of GHSA-r7fx-8g49-7hhr
ghsa·2026-06-18·CVSS 4.8
CVE-2026-55890 [MEDIUM] CWE-79 Grav: Stored CSS injection via Markdown image ?style=… reaches MediaObjectTrait::style() — incomplete patch of GHSA-r7fx-8g49-7hhr
Grav: Stored CSS injection via Markdown image ?style=… reaches MediaObjectTrait::style() — incomplete patch of GHSA-r7fx-8g49-7hhr
## Summary
The fix for **GHSA-r7fx-8g49-7hhr / CVE-2026-42841** (Stored XSS via Markdown media `attribute()` action) is incomplete. The maintainer patched `MediaObjectTrait::attribute()` to deny dangerous attribute names (event handlers, `style`, `xmlns`, `srcdoc`, `formaction`) but the sibling `MediaObjectTrait::style()` method is reachable through the **same Markdown excerpt-action pipeline** and writes editor-controlled strings straight into the rendered `` attribute with **no sanitization**.
Any user with `admin.pages` permission (e.g. an editor) can save Markdown like:
```markdown
```
which renders to a stored-CSS payload that any higher-privileged v
GHSA
Grav CMS vulnerable to stored XSS via Markdown media attribute() action
ghsa·2026-05-05
CVE-2026-42841 [MEDIUM] CWE-79 Grav CMS vulnerable to stored XSS via Markdown media attribute() action
Grav CMS vulnerable to stored XSS via Markdown media attribute() action
### Summary
An authenticated user with page editing permissions can inject an executable JavaScript event-handler attribute into rendered image HTML through Grav's Markdown media action syntax.
The issue is caused by Markdown image query parameters being converted into callable media actions. The public `attribute()` media method can be reached this way, allowing an editor to set an arbitrary HTML attribute name and value on the generated image element.
For example, this Markdown:
```markdown
)
```
is rendered as an image tag containing an executable `onload` handler:
```html
```
This results in stored XSS when another user views the affected page. In a multi-user Grav installation, a lower-privileged page edi
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-05-11
Published