Cross Site Scripting Vulnerability in GrandNode’s Product Description Handler
CVE-2026-112249

4.8MEDIUM

Key Information:

Vendor

Grandnode

Status
Grandnode2
Vendor
CVE Published:
19 October 2026

What is CVE-2026-112249?

A cross site scripting (XSS) vulnerability has been identified in the GrandNode application, specifically in the Product Description Handler. This issue arises in the Html.Raw function within the Product.Layout.Simple.cshtml file. Attackers can exploit this vulnerability remotely, potentially allowing them to inject malicious scripts that could compromise user data or facilitate unauthorized actions. It is crucial for users operating on GrandNode versions up to 2.3.0 to upgrade to version 2.4.0-beta or 2.4.0, where this vulnerability has been addressed. The patch for this vulnerability is identified by the commit hash 41a8e349eab8d9641cf6ea800d738f2d8991ca22.

Affected Version(s)

grandnode2 2.0

grandnode2 2.1

grandnode2 2.2

References

https://vuldb.com/vuln/422323
vdb-entrytechnical-description
https://vuldb.com/vuln/422323/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-112249
third-party-advisory

CVSS V4

Score:
4.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

sonnt0393 (VulDB User)
VulDB CNA Team
.