Cross-site scripting in grandnode2 product descriptions
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Cross-site scripting, Code execution
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79 and CWE-94.
Summary
grandnode2 up to 2.3.0 contains a cross-site scripting flaw (CWE-79) in the Html.Raw function of the product description component, used by Product.Layout.Simple.cshtml. A remote attacker with high privileges can launch the attack, and user interaction is required (UI:P). The CVSS 4.0 base score is 4.8 (MEDIUM), with low integrity impact and no confidentiality or availability impact.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
A vulnerability was detected in grandnode grandnode2 up to 2.3.0. Affected is the function Html.Raw of the file src/Web/Grand.Web/Views/Product/Product.Layout.Simple.cshtml of the component Product Description Handler. The manipulation results in cross site scripting. The attack can be launched remotely. Upgrading to version 2.4.0-beta and 2.4.0 is able to address this issue. The patch is identified as 41a8e349eab8d9641cf6ea800d738f2d8991ca22. Upgrading the affected component is recommended. The vendor was contacted early about this disclosure.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
Upgrade grandnode2 to 2.4.0-beta or 2.4.0. The patch is identified as 41a8e349eab8d9641cf6ea800d738f2d8991ca22.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
- Fix · CNA grandnode2 (grandnode) Fixed in 2.4.0-beta, 2.4.0
Timeline
- 2026-10-20 Threatist record created from CVE-2026-112249
- 2026-10-20 Alias added: GHSA-vxcv-8gxv-hggx
- 2026-10-23 CISA SSVC decision points changed
References
Patch 3
More grandnode vulnerabilities
- TI-2019-09161 A Path Traversal vulnerability in Controllers/LetsEncryptController.cs in… CVSS 3.0HIGH 7.5
- TI-2026-76570 Path traversal in grandnode2 Excel import of product pictures CVSS 4.0MEDIUM 5.1
Sources
- CVE-2026-112249 · CVE Program
- CVE-2026-112249 · NVD
- FIRST EPSS
- GHSA-vxcv-8gxv-hggx · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences