https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-19T09:59:07.779239+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-335728 EUVD-2026-335728 2026-10-19T09:59:07.828867+00:00 EUVD-2026-335728 https://cve.radiocsirt.org/vuln/fkie_cve-2026-55890 fkie_cve-2026-55890 2026-10-19T09:59:07.828907+00:00

Grav is a file-based Web platform. Prior to 2.0.0-rc.9, Grav's incomplete fix for stored XSS through the Markdown media attribute action (CVE-2026-42841) leaves the sibling MediaObjectTrait::style method reachable through the same Markdown excerpt-action pipeline, allowing an editor to save Markdown image style parameters that are written into the rendered img style attribute without sanitization. This issue is fixed in version 2.0.0-rc.9.

 https://cve.radiocsirt.org/vuln/ghsa-pmf8-g7c8-7v54 GHSA-pmf8-g7c8-7v54 — Grav: Stored CSS injection via Markdown image ?style=… reaches MediaObjectTrait::style() — incomplete patch of GHSA-r7f… 2026-10-19T09:59:07.828942+00:00

Affected: Packagist: getgrav/grav

## Summary

The fix for **GHSA-r7fx-8g49-7hhr / CVE-2026-42841** (Stored XSS via Markdown media `attribute()` action) is incomplete. The maintainer patched `MediaObjectTrait::attribute()` to deny dangerous attribute names (event handlers, `style`, `xmlns`, `srcdoc`, `formaction`) but the sibling `MediaObjectTrait::style()` method is reachable through the **same Markdown excerpt-action pipeline** and writes editor-controlled strings straight into the rendered `<img style="…">` attribute with **no sanitization**.

Any user with `admin.pages` permission (e.g. an editor) can save Markdown like:

```markdown ![logo](image.png?style=position:fixed;top:0;left:0;width:100vw;height:100vh;background:white;z-index:9999) ```

which renders to a stored-CSS payload that any higher-privileged viewer (administrator, super-admin, reviewer) loads in their authenticated session. Same trust boundary, same victim, same attacker, same Markdown input vector as the patched GHSA-r7fx-8g49-7hhr issue — the fix simply patched the `attribute()` entry point and missed the `style()` sibling.

## Affected versions

Vulnerable at HEAD across every currently-shipping branch (verified 2026-06-15):

| Branch / tag | `MediaObjectTrait::style()` | |---|---| | `develop` (`f4c0f42`) | unpatched | | `2.0` (`96e1d2d`) | unpatched | | `2.0.0-rc.8` (latest 2.0 RC tag) | unpatched | | `1.7.52` (latest 1.7 stable) | unpatched |

Per `SECURITY.md`, this advisory targets the **2.0 line** (publisher-level exploit, not eli…