CVE-2026-112249
Received Received - Intake

Cross-Site Scripting in GrandNode Product Description Handler

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: VulDB

Description
A vulnerability was detected in grandnode grandnode2 up to 2.3.0. Affected is the function Html.Raw of the file src/Web/Grand.Web/Views/Product/Product.Layout.Simple.cshtml of the component Product Description Handler. The manipulation results in cross site scripting. The attack can be launched remotely. Upgrading to version 2.4.0-beta and 2.4.0 is able to address this issue. The patch is identified as 41a8e349eab8d9641cf6ea800d738f2d8991ca22. Upgrading the affected component is recommended. The vendor was contacted early about this disclosure.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-112249
EUVD
EUVD-2026-104569

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
grandnode grandnode2 2.0
grandnode grandnode2 2.1
grandnode grandnode2 2.2
grandnode grandnode2 2.3.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-112249 is a stored cross-site scripting (XSS) vulnerability in GrandNode2, an e-commerce platform. It occurs due to an insecure HTML sanitization mechanism that used a bypassable blacklist to filter malicious input in product descriptions and other rich-text fields. Attackers with vendor privileges could inject malicious scripts that execute when rendered in admin interfaces, potentially leading to session hijacking or further exploitation.

Detection Guidance

To detect this vulnerability, inspect GrandNode2 instances running versions up to 2.3.0 for XSS payloads in product descriptions or rich-text fields. Check for unsanitized HTML in admin interfaces using browser developer tools. Verify if the NoScriptsAttribute blacklist is still active or if the HtmlSanitizer library is missing. Compare installed versions against 2.4.0-beta or 2.4.0.

Impact Analysis

If exploited, this vulnerability allows attackers to inject malicious scripts into product descriptions or other fields. When these fields are viewed by admin users, the scripts execute in the context of an authenticated admin session. This could lead to session hijacking, unauthorized actions, or further compromise of the system. The impact is higher for users with admin privileges.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate compliance requirements under GDPR (data protection) and HIPAA (health information privacy). Stored XSS could enable attackers to exfiltrate personal or health data, resulting in legal penalties, reputational damage, and loss of trust. Proper mitigation is essential to maintain compliance.

Mitigation Strategies

Upgrade GrandNode2 to version 2.4.0-beta or 2.4.0 immediately. Apply the patch commit 41a8e349eab8d9641cf6ea800d738f2d8991ca22. Ensure the HtmlSanitizer library is installed and configured. Review and sanitize legacy rich-text data using the provided migration script. Disable the SecurityConfig.EnableHtmlSanitization kill switch if enabled.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112249. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart