CVE-2026-112249
A vulnerability was detected in grandnode grandnode2 up to 2.3.0.
Does this matter?
Lower severity and a low EPSS score (0.40%). Track it; it rarely justifies an emergency change on its own.
Description
A vulnerability was detected in grandnode grandnode2 up to 2.3.0. Affected is the function Html.Raw of the file src/Web/Grand.Web/Views/Product/Product.Layout.Simple.cshtml of the component Product Description Handler. The manipulation results in cross site scripting. The attack can be launched remotely. Upgrading to version 2.4.0-beta and 2.4.0 is able to address this issue. The patch is identified as 41a8e349eab8d9641cf6ea800d738f2d8991ca22. Upgrading the affected component is recommended. The vendor was contacted early about this disclosure.
- CVSS 4.0
- 4.8 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 0.40% probability · 34th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-79, CWE-94
- Source
- cna@vuldb.com
EPSS moved from 0.4% on 20 October 2026 to 0.4% on 26 October 2026.
References
- https://github.com/grandnode/grandnode2/
- https://github.com/grandnode/grandnode2/commit/41a8e349eab8d9641cf6ea800d738f2d8991ca22
- https://github.com/grandnode/grandnode2/pull/780
- https://github.com/grandnode/grandnode2/releases/tag/2.4.0-beta
- https://github.com/grandnode/grandnode2/security/advisories/GHSA-cvpg-48r9-fq67
- https://vuldb.com/cve/CVE-2026-112249
- https://vuldb.com/submit/986350
- https://vuldb.com/vuln/422323
- https://vuldb.com/vuln/422323/cti
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.