CVE-2026-42841 Details
Description
Grav is a file-based Web platform. Prior to 2.0.0-beta.2, an authenticated user with page editing permissions can inject an executable JavaScript event-handler attribute into rendered image HTML through Grav's Markdown media action syntax. The issue is caused by Markdown image query parameters being converted into callable media actions. The public attribute() media method can be reached this way, allowing an editor to set an arbitrary HTML attribute name and value on the generated image element. This vulnerability is fixed in 2.0.0-beta.2.
A stored cross-site scripting vulnerability has been identified in Grav versions prior to 2.0.0-beta.2. The issue allows authenticated users with page editing permissions to inject executable JavaScript event-handler attributes into images using Grav's Markdown media action syntax. This is achieved by exploiting how Markdown image query parameters are processed and converted into media actions, ultimately allowing the injection of arbitrary HTML attributes that are executed when the image is rendered.
Users can update to Grav version 2.0.0-beta.2 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/getgrav/grav/security/advisories/GHSA-r7fx-8g49-7hhr | CISA-ADP | ExploitPatchVendor Advisory |
| https://github.com/getgrav/grav/commit/5a12f9be8314682c8713e569e330f11805d0a663 | [email protected] | Patch |
| https://github.com/getgrav/grav/security/advisories/GHSA-r7fx-8g49-7hhr | [email protected] | ExploitPatchVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| getgrav grav | <= 1.8.0 2.0.0 beta1 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 12, 2026 | Initial Analysis | [email protected] |
| May 11, 2026 | CVE Modified | CISA-ADP |
| May 11, 2026 | New CVE Received | [email protected] |