THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-ffmg-hfvg-jhg9 (medium) — Grav: Stored CSS injection via Markdown image resize() bypasses prior media style sanitizers in Grav

[GHSA] GHSA-ffmg-hfvg-jhg9 (medium) — Grav: Stored CSS injection via Markdown image resize() bypasses prior media style sanitizers in Grav

highgithub_advisoriesPublished 2026-09-16

GHSA-ffmg-hfvg-jhg9 Severity: medium CVE: CVE-2026-58657

Grav: Stored CSS injection via Markdown image resize() bypasses prior media style sanitizers in Grav

## Summary

Grav 2.0.0-rc.9 and the current 2.0 branch still allow stored CSS injection through Markdown image media actions. The prior media hardening rejects direct `?style=` payloads and unsafe `attribute()` fallbacks, but the adjacent `

MITRE ATT&CK techniques

JavaScriptT1059.007

Indicators of compromise

6582166173bb8eb5869d96aea384e0e73777c94csha1
e03d29aa0d3ece16d73c1ffccfa78df8bf5f28b8sha1
CVE-2026-58657cve

Original source: https://github.com/advisories/GHSA-ffmg-hfvg-jhg9