CVE-2026-58657: Grav: Stored CSS injection via Markdown image resize() bypasses prior media style sanitizers in Grav
Grav 2.0.0-rc.9 and the current 2.0 branch still allow stored CSS injection through Markdown image media actions. The prior media hardening rejects direct ?style= payloads and unsafe attribute() fallbacks, but the adjacent resize() action still writes caller-controlled values directly into styleAttributes.
A publisher who can edit page Markdown can store a crafted image URL that renders additional CSS declarations in the final <img style=...> attribute. This crosses the same lower-privileged publisher to higher-privileged reviewer/admin rendered-content boundary as the earlier media style and attribute advisories.
References
- github.com/advisories/GHSA-ffmg-hfvg-jhg9
- github.com/getgrav/grav/commit/6582166173bb8eb5869d96aea384e0e73777c94c
- github.com/getgrav/grav/commit/e03d29aa0d3ece16d73c1ffccfa78df8bf5f28b8
- github.com/getgrav/grav/security/advisories/GHSA-ffmg-hfvg-jhg9
- nvd.nist.gov/vuln/detail/CVE-2026-58657
- www.vulncheck.com/advisories/grav-stored-css-injection-via-markdown-image-resize-action
Code Behaviors & Features
Detect and mitigate CVE-2026-58657 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →