Is CVE-2026-42841 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-42841 being exploited in the wild.

How severe is CVE-2026-42841?

Medium severity, with a CVSS score of 4.8, published 11 May 2026.

Which products and versions are affected?

Grav < 2.0.0-beta.2; getgrav/grav (Packagist) < 2.0.0-beta.2, ECOSYSTEM:introduced=0,fixed=2.0.0-beta.2.

Is there a fix for CVE-2026-42841?

Yes. getgrav/grav (Packagist): upgrade to 2.0.0-beta.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-42841 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-42841?

Check whether you run Grav or getgrav/grav (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42841: getgrav Grav stored XSS via Markdown media attribute action

Q: Which products and versions are affected?

Grav < 2.0.0-beta.2; getgrav/grav (Packagist) < 2.0.0-beta.2, ECOSYSTEM:introduced=0,fixed=2.0.0-beta.2.

Q: Is there a fix for CVE-2026-42841?

Yes. getgrav/grav (Packagist): upgrade to 2.0.0-beta.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-42841 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-42841?

Check whether you run Grav or getgrav/grav (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42841 · Severity: medium · CVSS 4.8 · Published 2026-05-11

Grav is a web platform used for building and managing websites. A security flaw allows users with page-editing permissions to embed malicious scripts into images using special Markdown syntax. When other users, including administrators, view these pages, the scripts execute in their browsers, potentially leading to unauthorized actions or data theft.

Technologies: Grav, getgrav/grav (Packagist). Vendors: Grav, Packagist.

Quick answers

Is CVE-2026-42841 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-42841 being exploited in the wild.
How severe is CVE-2026-42841?: Medium severity, with a CVSS score of 4.8, published 11 May 2026.
Which products and versions are affected?: Grav < 2.0.0-beta.2; getgrav/grav (Packagist) < 2.0.0-beta.2, ECOSYSTEM:introduced=0,fixed=2.0.0-beta.2.
Is there a fix for CVE-2026-42841?: Yes. getgrav/grav (Packagist): upgrade to 2.0.0-beta.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42841 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-42841?: Check whether you run Grav or getgrav/grav (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

getgrav/grav (Packagist): upgrade to 2.0.0-beta.2 or later
```
composer require getgrav/grav:^2.0.0-beta.2
```

Technical details

A stored Cross-Site Scripting (XSS) vulnerability exists in Grav CMS due to improper neutralization of input in the Markdown media action syntax. The application converts Markdown image query parameters into callable media actions via 'call_user_func_array'. An attacker with page-editing privileges can invoke the 'attribute()' method to inject arbitrary HTML attributes, such as 'onload', into the final rendered '<img>' tag. Because the malicious payload is stored as Markdown rather than raw HTML, it bypasses the Admin Plugin's save-time XSS filters. The vulnerability is fixed in version 2.0.0-beta.2 by implementing a strict identifier regex and denylist for attribute names.

Affected products

getgrav Grav < 2.0.0-beta.2

Identifiers

CVE-2026-42841
GHSA-r7fx-8g49-7hhr

Timeline

2026-04-23: patched: Fix committed to repository
2026-04-27: advisory: GitHub Security Advisory published
2026-05-11: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.