जमा करें #986350: GrandNode grandnode2 <= 2.3.0 Cross Site Scripting

A stored Cross-Site Scripting (XSS) vulnerability was found in GrandNode grandnode2 up to 2.3.0. Affected is the product description handling. The application renders product description fields using @Html.Raw() in Razor views without any HTML sanitization, which allows stored JavaScript payloads to execute client-side.
Affected files:
src/Web/Grand.Web/Views/Product/Product.Layout.Simple.cshtml:77 - @Html.Raw(Model.ShortDescription)
src/Web/Grand.Web/Views/Product/Product.Layout.Simple.cshtml:215 - @Html.Raw(Model.FullDescription)
The admin panel accepts raw HTML in these fields through the product editor (rich text / source mode) and stores the value directly in MongoDB without sanitization. When any unauthenticated or authenticated user browses the affected product page, the payload executes automatically.
An authenticated administrator or vendor is able to inject arbitrary JavaScript that executes in the browser of any customer visiting the affected product page, leading to session cookie theft and account takeover.
The advisory was published on 2026-06-24 and rates the issue as High. No patched version is available at this time.
Note on CNA coordination: I am the reporter of this advisory, not a maintainer of the repository. On GitHub only maintainers and owners are able to request a CVE, so I was unable to request one myself. The maintainers have not responded and no CVE has been assigned since publication. The same product has previously received CVE-2025-10216 through VulDB after the vendor did not respond.

• स्रोत: ⚠️ https://github.com/grandnode/grandnode2/security/advisories/GHSA-cvpg-48r9-fq67
• उपयोगकर्ता: sonnt0393 (UID 101174)
• सबमिशन: 17/09/2026 11:19 AM (1 महीना पहले)
• संयम: 19/10/2026 02:48 PM (1 month later)
• स्थिति: स्वीकृत
• VulDB प्रविष्टि: 422323 [grandnode grandnode2 तक 2.3.0 Product Description Product.Layout.Simple.cshtml Html.Raw क्रॉस साइट स्क्रिप्टिंग]
• अंक: 20