GHSA-vxcv-8gxv-hggxMediumCVSS 2.4
A vulnerability was detected in grandnode grandnode2 up to 2.3.0. Affected is the function Html...
🔗 CVE IDs covered (1)
📋 Description
A vulnerability was detected in grandnode grandnode2 up to 2.3.0. Affected is the function Html.Raw of the file src/Web/Grand.Web/Views/Product/Product.Layout.Simple.cshtml of the component Product Description Handler. The manipulation results in cross site scripting. The attack can be launched remotely. Upgrading to version 2.4.0-beta and 2.4.0 is able to address this issue. The patch is identified as 41a8e349eab8d9641cf6ea800d738f2d8991ca22. Upgrading the affected component is recommended. The vendor was contacted early about this disclosure.
🔗 References (11)
- https://github.com/grandnode/grandnode2/security/advisories/GHSA-cvpg-48r9-fq67
- https://nvd.nist.gov/vuln/detail/CVE-2026-112249
- https://github.com/grandnode/grandnode2/pull/780
- https://github.com/grandnode/grandnode2/commit/41a8e349eab8d9641cf6ea800d738f2d8991ca22
- https://github.com/grandnode/grandnode2
- https://github.com/grandnode/grandnode2/releases/tag/2.4.0-beta
- https://vuldb.com/cve/CVE-2026-112249
- https://vuldb.com/submit/986350
- https://vuldb.com/vuln/422323
- https://vuldb.com/vuln/422323/cti
- https://github.com/advisories/GHSA-vxcv-8gxv-hggx