CVE-2026-58657 Grav - Stored CSS Injection via Markdown Image resize() Action

🗓️ 08 Jul 2026 13:49:12Reported by GoogleType

osv🔗 osv.dev👁 3 Views

Grav stored CSS injection in Markdown image resize parameters; writes to image style attribute and is fixed in version 2.0.0.

Reporter	Title	Published	Views	Family All 9
ATTACKERKB	CVE-2026-58657	8 Jul 202613:49	–	attackerkb
Circl	CVE-2026-58657	8 Jul 202616:52	–	circl
CVE	CVE-2026-58657	8 Jul 202613:49	–	cve
Cvelist	CVE-2026-58657 Grav - Stored CSS Injection via Markdown Image resize() Action	8 Jul 202613:49	–	cvelist
EUVD	EUVD-2026-42267	8 Jul 202613:49	–	euvd
NVD	CVE-2026-58657	8 Jul 202614:17	–	nvd
Positive Technologies	PT-2026-56446	8 Jul 202600:00	–	ptsecurity
Snyk	Cross-site Scripting (XSS)	8 Jul 202616:36	–	snyk
Vulnrichment	CVE-2026-58657 Grav - Stored CSS Injection via Markdown Image resize() Action	8 Jul 202613:49	–	vulnrichment

Source	Link
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2026/58xxx/CVE-2026-58657.json
github	www.github.com/getgrav/grav/security/advisories/GHSA-ffmg-hfvg-jhg9
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-58657
vulncheck	www.vulncheck.com/advisories/grav-stored-css-injection-via-markdown-image-resize-action
github	www.github.com/getgrav/grav/commit/6582166173bb8eb5869d96aea384e0e73777c94c
github	www.github.com/getgrav/grav/commit/e03d29aa0d3ece16d73c1ffccfa78df8bf5f28b8

15 Jul 2026 01:49Current

6.2Medium risk

Vulners AI Score6.2

CVSS 44.8

EPSS0.00217