CVE-2026-58657

Name of the Vulnerable Software and Affected Versions Grav versions prior to 2.0.0

Description A stored CSS injection exists in the Markdown image resize() media action. The resize() action within the Excerpts::processMediaActions() function writes caller-controlled values directly into the image's styleAttributes. A lower-privileged content editor can store a crafted image URL containing semicolon-delimited CSS declarations in the resize parameters. These declarations are rendered into the final <img style=...> attribute when a higher-privileged user views the page or preview. This allows for UI redress, overlay, and content-manipulation attacks, such as creating a full-viewport fixed overlay, without requiring JavaScript execution.

Recommendations Update to version 2.0.0.