CVE-2026-112249: grandnode grandnode2 Product Description Product.Layout.Simple.cshtml Html.Raw cross site scripting
A vulnerability was detected in grandnode grandnode2 up to 2.3.0. Affected is the function Html.Raw of the file src/Web/Grand.Web/Views/Product/Product.Layout.Simple.cshtml of the component Product Description Handler. The manipulation results in cross site scripting. The attack can be launched remotely. Upgrading to version 2.4.0-beta and 2.4.0 is able to address this issue. The patch is identified as 41a8e349eab8d9641cf6ea800d738f2d8991ca22. Upgrading the affected component is recommended. The vendor was contacted early about this disclosure.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
grandnode grandnode2to a version that resolves this vulnerability.Fixed in 2.4.0Patch 41a8e349eab8d9641cf6ea800d738f2d8991ca22
Event History
Frequently Asked Questions
Which deployments should be prioritized for remediation?
GrandNode grandnode2 deployments running version 2.3.0 or earlier are affected. The issue is in the Product Description Handler's Product.Layout.Simple.cshtml view.
What does exploitation require?
The attack can be initiated remotely, but the supplied CVSS vector indicates that an attacker needs high privileges and user interaction. Its impact is limited to integrity in the provided scoring information.
What is the available remediation?
Upgrade to version 2.4.0-beta or 2.4.0. The identified patch is 41a8e349eab8d9641cf6ea800d738f2d8991ca22.