https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 19 Oct 2026 09:09:58 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-335728 EUVD-2026-335728 https://cve.radiocsirt.org/vuln/euvd-2026-335728 https://cve.radiocsirt.org/vuln/fkie_cve-2026-55890 <p>Grav is a file-based Web platform. Prior to 2.0.0-rc.9, Grav&#39;s incomplete fix for stored XSS through the Markdown media attribute action (CVE-2026-42841) leaves the sibling MediaObjectTrait::style method reachable through the same Markdown excerpt-action pipeline, allowing an editor to save Markdown image style parameters that are written into the rendered img style attribute without sanitization. This issue is fixed in version 2.0.0-rc.9.</p> <p>Grav is a file-based Web platform. Prior to 2.0.0-rc.9, Grav&#39;s incomplete fix for stored XSS through the Markdown media attribute action (CVE-2026-42841) leaves the sibling MediaObjectTrait::style method reachable through the same Markdown excerpt-action pipeline, allowing an editor to save Markdown image style parameters that are written into the rendered img style attribute without sanitization. This issue is fixed in version 2.0.0-rc.9.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-55890 https://cve.radiocsirt.org/vuln/ghsa-pmf8-g7c8-7v54 <p><strong>Affected:</strong> Packagist: getgrav/grav</p> <p>## Summary</p> <p>The fix for **GHSA-r7fx-8g49-7hhr / CVE-2026-42841** (Stored XSS via Markdown media `attribute()` action) is incomplete. The maintainer patched `MediaObjectTrait::attribute()` to deny dangerous attribute names (event handlers, `style`, `xmlns`, `srcdoc`, `formaction`) but the sibling `MediaObjectTrait::style()` method is reachable through the **same Markdown excerpt-action pipeline** and writes editor-controlled strings straight into the rendered `&lt;img style=&#34;…&#34;&gt;` attribute with **no sanitization**.</p> <p>Any user with `admin.pages` permission (e.g. an editor) can save Markdown like:</p> <p>```markdown  ```</p> <p>which renders to a stored-CSS payload that any higher-privileged viewer (administrator, super-admin, reviewer) loads in their authenticated session. Same trust boundary, same victim, same attacker, same Markdown input vector as the patched GHSA-r7fx-8g49-7hhr issue — the fix simply patched the `attribute()` entry point and missed the `style()` sibling.</p> <p>## Affected versions</p> <p>Vulnerable at HEAD across every currently-shipping branch (verified 2026-06-15):</p> <p>| Branch / tag | `MediaObjectTrait::style()` | |---|---| | `develop` (`f4c0f42`) | unpatched | | `2.0` (`96e1d2d`) | unpatched | | `2.0.0-rc.8` (latest 2.0 RC tag) | unpatched | | `1.7.52` (latest 1.7 stable) | unpatched |</p> <p>Per `SECURITY.md`, this advisory targets the **2.0 line** (publisher-level exploit, not eli…</p> <p><strong>Affected:</strong> Packagist: getgrav/grav</p> <p>## Summary</p> <p>The fix for **GHSA-r7fx-8g49-7hhr / CVE-2026-42841** (Stored XSS via Markdown media `attribute()` action) is incomplete. The maintainer patched `MediaObjectTrait::attribute()` to deny dangerous attribute names (event handlers, `style`, `xmlns`, `srcdoc`, `formaction`) but the sibling `MediaObjectTrait::style()` method is reachable through the **same Markdown excerpt-action pipeline** and writes editor-controlled strings straight into the rendered `&lt;img style=&#34;…&#34;&gt;` attribute with **no sanitization**.</p> <p>Any user with `admin.pages` permission (e.g. an editor) can save Markdown like:</p> <p>```markdown  ```</p> <p>which renders to a stored-CSS payload that any higher-privileged viewer (administrator, super-admin, reviewer) loads in their authenticated session. Same trust boundary, same victim, same attacker, same Markdown input vector as the patched GHSA-r7fx-8g49-7hhr issue — the fix simply patched the `attribute()` entry point and missed the `style()` sibling.</p> <p>## Affected versions</p> <p>Vulnerable at HEAD across every currently-shipping branch (verified 2026-06-15):</p> <p>| Branch / tag | `MediaObjectTrait::style()` | |---|---| | `develop` (`f4c0f42`) | unpatched | | `2.0` (`96e1d2d`) | unpatched | | `2.0.0-rc.8` (latest 2.0 RC tag) | unpatched | | `1.7.52` (latest 1.7 stable) | unpatched |</p> <p>Per `SECURITY.md`, this advisory targets the **2.0 line** (publisher-level exploit, not eli…</p> https://cve.radiocsirt.org/vuln/ghsa-pmf8-g7c8-7v54