CVE-2026-112249CWE-79CWE-94cross-site-scriptingcode-injection

CVE-2026-112249

Low · published October 19, 2026

CVSS v3.1
2.4
EPSS
0%
Percentile
32.9
In the wild
Unconfirmed
What it is

A vulnerability was detected in grandnode grandnode2 up to 2.3.0. Affected is the function Html.Raw of the file src/Web/Grand.Web/Views/Product/Product.Layout.Simple.cshtml of the component Product Description Handler. The manipulation results in cross site scripting. The attack can be launched remotely. Upgrading to version 2.4.0-beta and 2.4.0 is able to address this issue. The patch is identified as 41a8e349eab8d9641cf6ea800d738f2d8991ca22. Upgrading the affected component is recommended. The vendor was contacted early about this disclosure.

The record
Technical detail
CVSS v3.1
2.4 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N
CVSS v4.0
4.8 · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X
EPSS
0.00398 · 32.9th percentile
Weaknesses
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'); CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-10-19T23:17Z
References (9)
https://github.com/grandnode/grandnode2/ · [email protected]https://github.com/grandnode/grandnode2/commit/41a8e349eab8d9641cf6ea800d738f2d8991ca22 · [email protected]https://github.com/grandnode/grandnode2/pull/780 · [email protected]https://github.com/grandnode/grandnode2/releases/tag/2.4.0-beta · [email protected]https://github.com/grandnode/grandnode2/security/advisories/GHSA-cvpg-48r9-fq67 · [email protected]https://vuldb.com/cve/CVE-2026-112249 · [email protected]https://vuldb.com/submit/986350 · [email protected]https://vuldb.com/vuln/422323 · [email protected]https://vuldb.com/vuln/422323/cti · [email protected]
EPSS history
Timeline
  • 21 OCT 03:27Z
    EPSS moved — → 0%
    epss
  • 19 OCT 18:15Z
    grandnode grandnode2 Product Description Product.Layout.Simple.cshtml Html.Raw cross site scripting
    cvelistv5
  • 19 OCT 18:15Z
    grandnode grandnode2 Product Description Product.Layout.Simple.cshtml Html.Raw cross site scripting
    cvelistv5