Grav, a file-based web platform, had an incomplete fix for a stored XSS vulnerability related to the Markdown media attribute action (previously CVE-2026-42841). The sibling MediaObjectTrait::style method remained accessible through the same Markdown excerpt-action pipeline, enabling an editor to save Markdown image style parameters that are rendered into the img style attribute without sanitization. This improper neutralization of input leads to a stored cross-site scripting vulnerability. The issue is resolved in version 2.0.0-rc.9.

Successful exploitation could allow an authenticated editor with permission to save Markdown content to inject malicious scripts via image style attributes. This may lead to partial compromise of confidentiality and integrity of the affected system's web interface. The CVSS 3.1 base score is 4.8 (medium severity), reflecting network attack vector, low attack complexity, required privileges and user interaction, and limited impact on confidentiality and integrity with no impact on availability.

The vulnerability is fixed in Grav version 2.0.0-rc.9. Users should upgrade to version 2.0.0-rc.9 or later to remediate this issue. No additional vendor advisory or patch information is provided, so check the official Grav project resources for confirmation and further guidance.