CVE-2026-112249

LowCVSS 2.4

Published: 19/10/2026(UTC)Updated: 22/10/2026(UTC)Translated: 20/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.40%

33th percentile - higher than 33% of all known CVEs

Summary

A vulnerability was detected in grandnode grandnode2 up to 2.3.0. It affects the Html.Raw function in the file src/Web/Grand.Web/Views/Product/Product.Layout.Simple.cshtml in the Product Description Handler component. Manipulation leads to cross-site scripting (XSS). The attack can be launched remotely. Upgrading to version 2.4.0-beta or 2.4.0 addresses the issue.

Risk Assessment

XSS vulnerability may allow an attacker to execute malicious script in the user's browser, steal sessions, or take over accounts. However, it requires interaction with the vulnerable component.

Recommendation

Update grandnode2 to version 2.4.0-beta or 2.4.0 (or later). Apply the security patch with identifier 41a8e349eab8d9641cf6ea800d738f2d8991ca22.

Other vulnerabilities in grandnode2

CVE-2026-112248Medium
A security vulnerability has been detected in grandnode grandnode2 up to 2.3.0, affecting the function ProductImportDataObject.PrepareProductPictures of the Excel Import component. Manipulation of the Picture1/Picture2/Picture3 arguments leads to path traversal, and the attack can be initiated remotely.

Original NVD description (English source)

A vulnerability was detected in grandnode grandnode2 up to 2.3.0. Affected is the function Html.Raw of the file src/Web/Grand.Web/Views/Product/Product.Layout.Simple.cshtml of the component Product Description Handler. The manipulation results in cross site scripting. The attack can be launched remotely. Upgrading to version 2.4.0-beta and 2.4.0 is able to address this issue. The patch is identified as 41a8e349eab8d9641cf6ea800d738f2d8991ca22. Upgrading the affected component is recommended. The vendor was contacted early about this disclosure.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS