An authenticated page editor can inject an executable JavaScript event-handler attribute into the rendered image HTML by using Grav’s Markdown media action syntax. The public attribute() media method accepts arbitrary attribute names and values, which allows a crafted image tag to supply a malicious attribute that the browser executes. This flaw enables a stored cross‑site scripting (CXX) attack as described by CWE‑79.

The vulnerability affects the Grav CMS, specifically all releases prior to 2.0.0-beta.2. Users of getgrav:grav with page editing privileges are vulnerable if image tags use the attribute() style syntax.

The CVSS score is 6.9, indicating a moderate impact. The EPSS score is not available, and the flaw is not listed in the CISA KEV catalog. Because the attacker must be an authenticated user with editing rights, the attack requires legitimate credentials or compromised accounts. Once attacker injects a malicious image tag, the resulting stored XSS can run in the browser context of any visitor to the page and potentially exfiltrate credentials, session cookies, or perform other malicious actions.