THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-6qw9-4vv5-jr97 (medium) — Grav: Stored XSS via Markdown audio/video media <source> URL

[GHSA] GHSA-6qw9-4vv5-jr97 (medium) — Grav: Stored XSS via Markdown audio/video media <source> URL

highgithub_advisoriesPublished 2026-09-17

GHSA-6qw9-4vv5-jr97 Severity: medium CVE: CVE-2026-75831

Grav: Stored XSS via Markdown audio/video media <source> URL

**Target:** github.com/getgrav/grav **Affected resource:** `Grav\Common\Media\Traits\AudioMediaTrait` / `VideoMediaTrait` `sourceParsedownElement()` — verified on 2.0.13 (latest stable) and `develop` HEAD `5a7070f` **Severity:** Medium (~6.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C

MITRE ATT&CK techniques

JavaScriptT1059.007

Indicators of compromise

aba291a59cab29ddce491175791888d8d0b65e20sha1
CVE-2026-75831cve
CVE-2026-42841cve
CVE-2026-55890cve
http://127.0.0.1:8390/pocurl
http://127.0.0.1:8390/poc`url

Original source: https://github.com/advisories/GHSA-6qw9-4vv5-jr97