Live › vulnerability › CVE-2026-112249
Go to dashboardGrandnode2 up to 2.3.0 renders product descriptions through Html.Raw in a product layout view without encoding them, so stored or submitted markup runs as script. An attacker who can put content into a product description can run script in the browser of anyone who views that product page.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Stores running grandnode2 2.3.0 or earlier where product descriptions can be written by someone other than trusted staff, such as multi-vendor or user-submitted content. Shops where only trusted administrators edit descriptions face a much smaller risk, though the upgrade still applies.
No product ranges from the sources yet.
2.3.0 and earlier are affected per the source.src/Web/Grand.Web/Views/Product/Product.Layout.Simple.cshtml and look for Html.Raw around the product description.2.4.0 (or 2.4.0-beta), per the source.41a8e349eab8d9641cf6ea800d738f2d8991ca22 if you cannot upgrade yet.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was detected in grandnode grandnode2 up to 2.3.0. Affected is the function Html.Raw of the file src/Web/Grand.Web/Views/Product/Product.Layout.Simple.cshtml of the component Product Description Handler. The manipulation results in cross site scripting. The attack can be launched remotely. Upgrading to version 2.4.0-beta and 2.4.0 is able to address this issue. The patch is identified as 41a8e349eab8d9641cf6ea800d738f2d8991ca22. Upgrading the affected component is recommended. The vendor was contacted early about this disclosure.
This page as .md · .json · in your agent: get_signal("CVE-2026-112249")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.