CVE-2026-42841 - Vulnerability Analysis
MediumCVSS: 4.8Last Updated: May 12, 2026
Grav - Stored XSS
Published: May 11, 2026Updated: May 12, 2026PoC AvailableRemote Exploitable
Overview
Grav < 2.0.0-beta.2 contains a stored XSS caused by Markdown image query parameters converted into callable media actions, letting authenticated users with page editing permissions inject executable JavaScript in image HTML.
Severity & Score
Severity: Medium
CVSS Score: 4.8
Impact
Authenticated users with page editing permissions can execute arbitrary JavaScript, potentially leading to session hijacking or further attacks.
Mitigation
Update to version 2.0.0-beta.2 or later.
References
Related Resources
Details
- CVE ID
- CVE-2026-42841
- Severity
- Medium
- CVSS Score
- 4.8
- Type
- stored_xss
- Status
- confirmed
CWE
- CWE-79
CVSS Metrics
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N