GHSA-PMF8-G7C8-7V54 Grav: Stored CSS injection via Markdown image ?style=… reaches MediaObjectTrait::style() — incomplete patch of GHSA-r7fx-8g49-7hhr

Summary The fix for GHSA-r7fx-8g49-7hhr / CVE-2026-42841 Stored XSS via Markdown media attribute action is incomplete. The maintainer patched MediaObjectTrait::attribute to deny dangerous attribute names event handlers, style, xmlns, srcdoc, formaction but the sibling MediaObjectTrait::style meth...

MAL-2025-44142 Malicious code in epimetheus-html-webpack-plugin-markdown-style-loader (npm)

The package epimetheus-html-webpack-plugin-markdown-style-loader was found to contain malicious code...

Malicious code in epimetheus-html-webpack-plugin-markdown-style-loader (npm)

The package epimetheus-html-webpack-plugin-markdown-style-loader was found to contain malicious code...