Medium severity4.8GHSA Advisory· Published Jul 10, 2026· Updated Jul 10, 2026

CVE-2026-55890

Description

Grav is a file-based Web platform. Prior to 2.0.0-rc.9, Grav's incomplete fix for stored XSS through the Markdown media attribute action (CVE-2026-42841) leaves the sibling MediaObjectTrait::style method reachable through the same Markdown excerpt-action pipeline, allowing an editor to save Markdown image style parameters that are written into the rendered img style attribute without sanitization. This issue is fixed in version 2.0.0-rc.9.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
getgrav/gravPackagist	< 2.0.0-rc.9	2.0.0-rc.9

Affected products

Getgrav/GravGHSA
Range: <= 2.0.0-rc.8

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-pmf8-g7c8-7v54ghsaADVISORY
github.com/getgrav/grav/commit/5a12f9be8ghsaWEB
github.com/getgrav/grav/security/advisories/GHSA-pmf8-g7c8-7v54nvdWEB
github.com/getgrav/grav/commit/24fd6cbc438e12310b126d1176e7d7601203a6f2nvd
github.com/getgrav/grav/releases/tag/2.0.0-rc.9nvd

News mentions

No linked articles in our index yet.

cvss	0.312
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000