CVE-2026-42841Disclosure(getgrav / grav)

LOWCVSS 4.8 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Grav is a file-based Web platform. Prior to 2.0.0-beta.2, an authenticated user with page editing permissions can inject an executable JavaScript event-handler attribute into rendered image HTML through Grav's Markdown media action syntax. The issue is caused by Markdown image query parameters being converted into callable media actions. The public attribute() media method can be reached this way, allowing an editor to set an arbitrary HTML attribute name and value on the generated image element. This vulnerability is fixed in 2.0.0-beta.2.

getgrav CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Patch / fix

Exploit / PoC references

Weakness type (CWE)

CWE-79

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

grav

Threat summary

4 mentions across 2 observed days
Momentum state: stable

What's happening

Technical details provided in 4 signals
Disclosure: 3 classified signals
General: 1 classified signal
Peaked 1d ago at 3 mentions (2026-05-11); latest day: 1
4 total mentions across 2 days

Affected systems

Vendors

getgrav

Products

grav

1 version affected across 1 product

Deep dive

Activity timeline4 mentions / 2d

Signal classification2 categories

Disclosure

375.0%

General

125.0%

Referenced assets5 URLs

By indicator

Classification over time

Date	Total	Labels

2026-05-11	3	Disclosure2General1
2026-09-17	1	Disclosure1

Full discourse4 posts

Infoflowcloud@infoflowcloud150d
Disclosure
🚨*CVE* CVE-2026-42841 Grav is a file-based Web platform. Prior to 2.0.0-beta.2, an authenticated user with page editing permissions can inject an executable JavaScript event-handler attrib… https://www.cve.org/CVERecord?id=CVE-2026-42841 ----- Traducción: CVE-2026-42841 Gra… http://infoflow.cloud`
Post summary
The post announces CVE-2026-42841, describing a JavaScript injection flaw in Grav before version 2.0.0‑beta.2, but provides no PoC, exploit, or remediation details.
0001028
77 followersView on X
DailyCVE@dailycve21d
Disclosure
🟠 Grav CMS, Audio/Video rawHtml XSS, #CVE ID: N/A (sibling #CVE-2026-42841, #CVE-2026-55890) (Medium) -DC-Sep2026-2431 https://dailycve.com/grav-cms-audio-video-rawhtml-xss-cve-id-n-a-sibling-cve-2026-42841-cve-2026-55890-medium-dc-sep2026-2431/
Post summary
The tweet discloses a Medium‑severity XSS vulnerability in Grav CMS's Audio/Video rawHtml functionality (main CVE ID N/A, with sibling CVEs #2026‑42841 and #2026‑55890). No Proof of Concept, exploit code, patch, or indication of active exploitation is provided.
0000061
236 followersView on X
CVE@CVEnew150d
Disclosure
CVE-2026-42841 Grav is a file-based Web platform. Prior to 2.0.0-beta.2, an authenticated user with page editing permissions can inject an executable JavaScript event-handler attrib… https://www.cve.org/CVERecord?id=CVE-2026-42841
Post summary
The snippet announces CVE-2026-42841 in Grav, highlighting that authenticated page editors can inject executable JavaScript via event‑handler attributes in versions prior to 2.0.0‑beta.2.
00000104
57.5K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds150d
General
CVE-2026-42841 Authenticated Cross-Site Scripting via Markdown Media Action Synt... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-42841 Customizable Vulnerability Alerts: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=4
Post summary
The tweet merely announces CVE-2026-42841 and directs readers to a Vulmon page, offering minimal technical detail but no PoC, exploit, or patch information.
0000037
4.0K followersView on X

CPE platform detail2 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

2 of 2 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	getgrav	grav	-	-	-
App	getgrav	grav	2.0.0	-	-

Explore more

Back to dashboard getgrav CVEs grav vulnerabilities

What researchers are saying

CVE-2026-42841

Infoflowcloud@infoflowcloudDisclosure

The post announces CVE-2026-42841, describing a JavaScript injection flaw in Grav before version 2.0.0‑beta.2, but provides no PoC, exploit, or remediation details.

DailyCVE@dailycveDisclosure

The tweet discloses a Medium‑severity XSS vulnerability in Grav CMS's Audio/Video rawHtml functionality (main CVE ID N/A, with sibling CVEs #2026‑42841 and #2026‑55890). No Proof of Concept, exploit code, patch, or indication of active exploitation is provided.

CVE@CVEnewDisclosure

The snippet announces CVE-2026-42841 in Grav, highlighting that authenticated page editors can inject executable JavaScript via event‑handler attributes in versions prior to 2.0.0‑beta.2.

Vulmon Vulnerability Feed@VulmonFeedsGeneral

The tweet merely announces CVE-2026-42841 and directs readers to a Vulmon page, offering minimal technical detail but no PoC, exploit, or patch information.