Technical impact
Grav is a file‑based web platform. Prior to version 2.0.0‑rc.9, an incomplete fix for stored XSS through the Markdown media attribute action (CVE‑2026‑42841) allowed the sibling MediaObjectTrait::style method to be reached by the same Markdown excerpt‑action pipeline. This lets an editor embed CSS style parameters in the Markdown image syntax, which are then written directly into the rendered <img> style attribute without sanitization. The issue is fixed in version 2.0.0‑rc.9.
Affected Systems
All releases of the Grav content‑management system from getgrav prior to 2.0.0‑rc.9 are affected. Users should verify their installation and upgrade to 2.0.0‑rc.9, which contains the fix for this weakness.
Risk and Exploitability
The CVSS score is 4.8, reflecting a low overall score, while the EPSS score is < 1%, indicating a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to have editor privileges to save malicious Markdown content; once stored, all subsequent visitors will trigger the XSS. No public exploit scripts are known, so the risk remains primarily theoretical in the absence of compromised editors.
Github GHSA