PT-2026-117585 · Grandnode · Grandnode

Sonnt0393

+1

·

CVE-2026-112249

·

Published

2026-10-19

·

Updated

2026-10-19

CVSS v4.0

4.8

Medium

VectorAV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X
Name of the Vulnerable Software and Affected Versions grandnode grandnode2 versions prior to 2.4.0-beta
Description A remote cross site scripting issue exists within the Product Description Handler component. The flaw is located in the Html.Raw() function within the file src/Web/Grand.Web/Views/Product/Product.Layout.Simple.cshtml. Cross site scripting is a technique where malicious scripts are injected into trusted websites.
Recommendations Update to version 2.4.0-beta or 2.4.0.

Exploit

Fix

Code Injection

XSS

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-94CWE-79

Related Identifiers

CVE-2026-112249
GHSA-CVPG-48R9-FQ67

Affected Products

Grandnode