CVE-2026-55890

Grav is a file-based Web platform. Prior to 2.0.0-rc.9, Grav's incomplete fix for stored XSS through the Markdown media attribute action (CVE-2026-42841) leaves the sibling MediaObjectTrait::style method reachable through the same Markdown excerpt-action pipeline, allowing an editor to save Markdown image style parameters that are written into the rendered img style attribute without sanitization. This issue is fixed in version 2.0.0-rc.9.

• CWE-79

• https://github.com/getgrav/grav/commit/24fd6cbc438e12310b126d1176e7d7601203a6f2
• https://github.com/getgrav/grav/releases/tag/2.0.0-rc.9
• https://github.com/getgrav/grav/security/advisories/GHSA-pmf8-g7c8-7v54
• https://github.com/getgrav/grav/security/advisories/GHSA-pmf8-g7c8-7v54

Published

Jul 10, 2026

Last Modified

Jul 10, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-55882Tilt defines dev environments as code for microservice apps …8.3
• CVE-2026-55883Tilt defines dev environments as code for microservice apps …8.3
• CVE-2026-55884Tilt defines dev environments as code for microservice apps …9.2
• CVE-2026-55885Grav is a file-based Web platform. Prior to 1.7.53, an authe…6.8
• CVE-2026-55886Jodit Editor is a WYSIWYG editor with written in pure TypeSc…6.3
• CVE-2026-5589An integer underflow in bt_mesh_sol_recv() in the Bluetooth …6.3
• CVE-2026-55892Vim is an open source, command line text editor. Prior to 9.…5.5
• CVE-2026-55895Vim is an open source, command line text editor. Prior to 9.…7.8
• CVE-2026-55898Out-of-bounds read in Microsoft Office Excel allows an unaut…7.1
• CVE-2026-55899Stack-based buffer overflow in Microsoft Office Excel allows…7.8
• CVE-2026-5590A race condition during TCP connection teardown can cause tc…5.3
• CVE-2026-5594A weakness has been identified in premAI-io premsql up to 0.…6.3