CVE-2026-55890
published 2026-07-10CVE-2026-55890: Grav is a file-based Web platform. Prior to 2.0.0-rc.9, Grav's incomplete fix for stored XSS through the Markdown media attribute action (CVE-2026-42841)…
PriorityP424medium4.8CVSS 3.1
AVNACLPRHUIRSCCLILAN
EPSS
0.50%
42.8th percentile
Grav is a file-based Web platform. Prior to 2.0.0-rc.9, Grav's incomplete fix for stored XSS through the Markdown media attribute action (CVE-2026-42841) leaves the sibling MediaObjectTrait::style method reachable through the same Markdown excerpt-action pipeline, allowing an editor to save Markdown image style parameters that are written into the rendered img style attribute without sanitization. This issue is fixed in version 2.0.0-rc.9.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| getgrav | grav | >= 0 < 2.0.15 | 2.0.15 |
| getgrav | grav | >= 0 < 2.0.0-rc.9 | 2.0.0-rc.9 |
CVSS provenance
nvdv3.14.8MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
ghsa4.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Grav: Stored XSS via Markdown audio/video media <source> URL
ghsa·2026-09-17·CVSS 4.8
CVE-2026-75831 [MEDIUM] CWE-79 Grav: Stored XSS via Markdown audio/video media <source> URL
Grav: Stored XSS via Markdown audio/video media URL
**Target:** github.com/getgrav/grav
**Affected resource:** `Grav\Common\Media\Traits\AudioMediaTrait` / `VideoMediaTrait` `sourceParsedownElement()` — verified on 2.0.13 (latest stable) and `develop` HEAD `5a7070f`
**Severity:** Medium (~6.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N — anchored to the sibling script-XSS advisory [CVE-2026-42841](https://github.com/getgrav/grav/security/advisories/GHSA-r7fx-8g49-7hhr), same PR:H / S:C / C:H / I:L)
**Weakness:** CWE-79 (Improper Neutralization of Input During Web Page Generation)
## Summary
A Markdown audio or video embed renders its `` element as **raw HTML** with the media URL concatenated unescaped. The URL fragment is reflected without any encoding, so `` breaks out of `` and injec
VulDB
getgrav Markdown Image MediaObjectTrait::style cross site scripting
vuldb·2026-06-21
CVE-2026-55890 [LOW] getgrav Markdown Image MediaObjectTrait::style cross site scripting
A vulnerability classified as problematic has been found in getgrav grav. This vulnerability affects the function MediaObjectTrait::style of the component Markdown Image Handler. This manipulation of the argument style causes cross site scripting.
This vulnerability is registered as CVE-2026-55890. Remote exploitation of the attack is possible. No exploit is available.
It is recommended to upgrade the affected component.
GHSA
Grav: Stored CSS injection via Markdown image ?style=… reaches MediaObjectTrait::style() — incomplete patch of GHSA-r7fx-8g49-7hhr
ghsa·2026-06-18·CVSS 4.8
CVE-2026-55890 [MEDIUM] CWE-79 Grav: Stored CSS injection via Markdown image ?style=… reaches MediaObjectTrait::style() — incomplete patch of GHSA-r7fx-8g49-7hhr
Grav: Stored CSS injection via Markdown image ?style=… reaches MediaObjectTrait::style() — incomplete patch of GHSA-r7fx-8g49-7hhr
## Summary
The fix for **GHSA-r7fx-8g49-7hhr / CVE-2026-42841** (Stored XSS via Markdown media `attribute()` action) is incomplete. The maintainer patched `MediaObjectTrait::attribute()` to deny dangerous attribute names (event handlers, `style`, `xmlns`, `srcdoc`, `formaction`) but the sibling `MediaObjectTrait::style()` method is reachable through the **same Markdown excerpt-action pipeline** and writes editor-controlled strings straight into the rendered `` attribute with **no sanitization**.
Any user with `admin.pages` permission (e.g. an editor) can save Markdown like:
```markdown
```
which renders to a stored-CSS payload that any higher-privileged v
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-07-10
Published