CVE-2026-55890: Stored XSS in Grav Markdown Media Style Attributes

Technical summary

Prior to Grav 2.0.0-rc.9, the MediaObjectTrait::style method remains accessible through the Markdown media attribute action pipeline despite an earlier fix addressing CVE-2026-42841. The vulnerability allows unsanitized style parameters from Markdown image syntax to be written directly into rendered HTML img style attributes. An authenticated user with editor permissions can craft Markdown containing malicious CSS or JavaScript-bearing style values that bypass the incomplete prior remediation. The fix in 2.0.0-rc.9 properly sanitizes these style attributes before rendering.

Business impact

This vulnerability poses a moderate risk primarily to instances where untrusted editors have Markdown publishing access. Successful exploitation allows injection of malicious scripts that execute in the context of other users' browsers, potentially enabling session hijacking, credential theft, or malware distribution. Content management systems often serve as trust anchors; compromise of the editorial workflow undermines that trust. Organizations relying on role-based access controls to isolate editor permissions should note that this vulnerability requires only editor-level access, not administrative privileges.

Affected systems

Grav versions prior to 2.0.0-rc.9 are affected. The vulnerability is reachable only through the Markdown editing and rendering pipeline when users with editor permissions save content containing malicious image style attributes. Instances without untrusted editors, or those running 2.0.0-rc.9 or later, are not affected.

Exploitability

Exploitation requires authentication and editor-level permissions, which limits the attack surface significantly. No network-level or unauthenticated exploitation is possible. However, the barrier to exploitation for an insider or compromised editor account is low: a single Markdown edit containing crafted style parameters can introduce persistent XSS that affects all viewers of that page. User interaction is required for the victim (the page viewer) to be affected, but this is automatic upon page load, making it effective in practice.

Remediation

Upgrade to Grav 2.0.0-rc.9 or later. If immediate patching is not possible, restrict editor permissions to trusted personnel only and implement additional output encoding at the web server or CDN layer if feasible. Review audit logs for any Markdown edits containing suspicious style attributes or CSS/JavaScript patterns.

Patch guidance

Update Grav to version 2.0.0-rc.9 or later. This version includes proper sanitization of style attributes in the Markdown media pipeline. Test the upgrade in a non-production environment to ensure compatibility with custom plugins or themes before deploying to production. The fix is contained in the core rendering engine and should not require additional configuration changes.

Detection guidance

Search Grav installation logs and content revision histories for Markdown images with style attributes containing JavaScript event handlers (e.g., onerror, onload) or suspicious CSS properties. Monitor HTML rendered output for img tags with unsanitized style attributes. Web application firewalls can be configured to detect style attribute payloads in Markdown submissions, though signature-based detection should account for encoding variations. Note that this vulnerability requires stored content, so focus detection efforts on content repositories rather than network traffic.

Why prioritize this

Although the CVSS score of 4.8 indicates medium severity, prioritization should be elevated if your Grav instance has untrusted or semi-trusted editors, if the platform serves sensitive content requiring integrity assurance, or if viewers include high-value targets (executives, customers). The incomplete fix for a prior similar vulnerability suggests this code path has attracted security attention and warrants closure. Conversely, instances with strictly controlled, trusted editorial access may defer patching with less urgency.

Risk score, explained

The CVSS 3.1 score of 4.8 reflects the attack vector (network-accessible), low complexity, high privilege requirement (editor access), required user interaction (page view), and cross-site impact. The score appropriately penalizes the need for authentication and user interaction. However, the score does not capture organizational risk factors such as the sensitivity of content being edited or the trustworthiness of the editor population, which should inform your internal risk rating.

Frequently asked questions