---
id: CVE-2026-112249
title: >-
  grandnode grandnode2 Product Description Product.Layout.Simple.cshtml Html.Raw
  cross site scripting
summary: >-
  A vulnerability was detected in grandnode grandnode2 up to 2.3.0. Affected is
  the function Html.Raw of the file
  src/Web/Grand.Web/Views/Product/Product.Layout.Simple.cshtml of the component
  Product Description Handler. The manipulation r…
severity: low
cvss: 2.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:X/RL:O/RC:C'
cvssSource: cna
cwe:
  - CWE-79
  - CWE-94
vendor: grandnode
product: grandnode2
affected:
  - grandnode2 2.0
  - grandnode2 2.1
  - grandnode2 2.2
  - grandnode2 2.3.0
published: '2026-10-19'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T18:15:20.969Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-112249'
references:
  - url: 'https://vuldb.com/vuln/422323'
    label: >-
      VDB-422323 | grandnode grandnode2 Product Description
      Product.Layout.Simple.cshtml Html.Raw cross site scripting
  - url: 'https://vuldb.com/vuln/422323/cti'
    label: 'VDB-422323 | CTI Indicators (IOB, IOC, TTP, IOA)'
  - url: 'https://vuldb.com/cve/CVE-2026-112249'
    label: CVE-2026-112249 | CVE Analysis and Report
  - url: 'https://vuldb.com/submit/986350'
    label: 'Submit #986350 | GrandNode grandnode2 <= 2.3.0 Cross Site Scripting'
  - url: >-
      https://github.com/grandnode/grandnode2/security/advisories/GHSA-cvpg-48r9-fq67
  - url: 'https://github.com/grandnode/grandnode2/pull/780'
  - url: >-
      https://github.com/grandnode/grandnode2/commit/41a8e349eab8d9641cf6ea800d738f2d8991ca22
  - url: 'https://github.com/grandnode/grandnode2/releases/tag/2.4.0-beta'
  - url: 'https://github.com/grandnode/grandnode2/'
tags:
  - cve.org
ingestedAt: '2026-10-19T18:35:50.129Z'
---

## Overview

A vulnerability was detected in grandnode grandnode2 up to 2.3.0. Affected is the function Html.Raw of the file src/Web/Grand.Web/Views/Product/Product.Layout.Simple.cshtml of the component Product Description Handler. The manipulation results in cross site scripting. The attack can be launched remotely. Upgrading to version 2.4.0-beta and 2.4.0 is able to address this issue. The patch is identified as 41a8e349eab8d9641cf6ea800d738f2d8991ca22. Upgrading the affected component is recommended. The vendor was contacted early about this disclosure.

## Affected

- `grandnode2 2.0`
- `grandnode2 2.1`
- `grandnode2 2.2`
- `grandnode2 2.3.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.