---
id: "CVE-2026-112249"
kind: "vulnerability"
aliases: ["CVE-2026-112249"]
title: "grandnode2: product description template lets scripts run in shoppers' browsers"
severity: "medium"
cvss: 4.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["dotnet", "e-commerce", "grandnode2", "package"]
not_affected_if: ["default-config"]
published_at: "2026-10-19T19:17:26+00:00"
first_seen_at: "2026-10-23T21:57:19+00:00"
updated_at: "2026-10-25T04:33:28+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112249", "first_seen_at": "2026-10-23T21:57:19+00:00"}]
---

# grandnode2: product description template lets scripts run in shoppers' browsers

Grandnode2 up to 2.3.0 renders product descriptions through Html.Raw in a product layout view without encoding them, so stored or submitted markup runs as script. An attacker who can put content into a product description can run script in the browser of anyone who views that product page.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed grandnode2 version; `2.3.0` and earlier are affected per the source.
- Open `src/Web/Grand.Web/Views/Product/Product.Layout.Simple.cshtml` and look for `Html.Raw` around the product description.
- Check whether untrusted users or vendors can edit product descriptions.

## Fix

- Upgrade grandnode2 to `2.4.0` (or `2.4.0-beta`), per the source.
- Apply the upstream patch `41a8e349eab8d9641cf6ea800d738f2d8991ca22` if you cannot upgrade yet.

## Timeline

- 2026-10-23T21:57:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112249

## From the sources

A vulnerability was detected in grandnode grandnode2 up to 2.3.0. Affected is the function Html.Raw of the file src/Web/Grand.Web/Views/Product/Product.Layout.Simple.cshtml of the component Product Description Handler. The manipulation results in cross site scripting. The attack can be launched remotely. Upgrading to version 2.4.0-beta and 2.4.0 is able to address this issue. The patch is identified as 41a8e349eab8d9641cf6ea800d738f2d8991ca22. Upgrading the affected component is recommended. The vendor was contacted early about this disclosure.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_