Medium severity4.8GHSA Advisory· Published May 11, 2026· Updated May 12, 2026
CVE-2026-42841
CVE-2026-42841
Description
Grav is a file-based Web platform. Prior to 2.0.0-beta.2, an authenticated user with page editing permissions can inject an executable JavaScript event-handler attribute into rendered image HTML through Grav's Markdown media action syntax. The issue is caused by Markdown image query parameters being converted into callable media actions. The public attribute() media method can be reached this way, allowing an editor to set an arbitrary HTML attribute name and value on the generated image element. This vulnerability is fixed in 2.0.0-beta.2.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
getgrav/gravPackagist | < 2.0.0-beta.2 | 2.0.0-beta.2 |
Affected products
4Patches
Vulnerability mechanics
References
4- github.com/getgrav/grav/commit/5a12f9be8314682c8713e569e330f11805d0a663nvdPatchWEB
- github.com/advisories/GHSA-r7fx-8g49-7hhrghsaADVISORY
- github.com/getgrav/grav/security/advisories/GHSA-r7fx-8g49-7hhrnvdVendor AdvisoryExploitPatchWEB
- nvd.nist.gov/vuln/detail/CVE-2026-42841ghsaADVISORY
News mentions
0No linked articles in our index yet.