| 제목 | GrandNode grandnode2 <= 2.3.0 Cross Site Scripting |
|---|
| 설명 | A stored Cross-Site Scripting (XSS) vulnerability was found in GrandNode grandnode2 up to 2.3.0. Affected is the product description handling. The application renders product description fields using @Html.Raw() in Razor views without any HTML sanitization, which allows stored JavaScript payloads to execute client-side.
Affected files:
src/Web/Grand.Web/Views/Product/Product.Layout.Simple.cshtml:77 - @Html.Raw(Model.ShortDescription)
src/Web/Grand.Web/Views/Product/Product.Layout.Simple.cshtml:215 - @Html.Raw(Model.FullDescription)
The admin panel accepts raw HTML in these fields through the product editor (rich text / source mode) and stores the value directly in MongoDB without sanitization. When any unauthenticated or authenticated user browses the affected product page, the payload executes automatically.
An authenticated administrator or vendor is able to inject arbitrary JavaScript that executes in the browser of any customer visiting the affected product page, leading to session cookie theft and account takeover.
The advisory was published on 2026-06-24 and rates the issue as High. No patched version is available at this time.
Note on CNA coordination: I am the reporter of this advisory, not a maintainer of the repository. On GitHub only maintainers and owners are able to request a CVE, so I was unable to request one myself. The maintainers have not responded and no CVE has been assigned since publication. The same product has previously received CVE-2025-10216 through VulDB after the vendor did not respond. |
|---|
| 원천 | ⚠️ https://github.com/grandnode/grandnode2/security/advisories/GHSA-cvpg-48r9-fq67 |
|---|
| 사용자 | sonnt0393 (UID 101174) |
|---|
| 제출 | 2026. 09. 17. AM 11:19 (1 월 ago) |
|---|
| 모더레이션 | 2026. 10. 19. PM 02:48 (1 month later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 422323 [grandnode grandnode2 까지 2.3.0 Product Description Product.Layout.Simple.cshtml Html.Raw 크로스 사이트 스크립팅] |
|---|
| 포인트들 | 20 |
|---|