Submit #986350: GrandNode grandnode2 <= 2.3.0 Cross Site Scripting

A stored Cross-Site Scripting (XSS) vulnerability was found in GrandNode grandnode2 up to 2.3.0. Affected is the product description handling. The application renders product description fields using @Html.Raw() in Razor views without any HTML sanitization, which allows stored JavaScript payloads to execute client-side.
Affected files:
src/Web/Grand.Web/Views/Product/Product.Layout.Simple.cshtml:77 - @Html.Raw(Model.ShortDescription)
src/Web/Grand.Web/Views/Product/Product.Layout.Simple.cshtml:215 - @Html.Raw(Model.FullDescription)
The admin panel accepts raw HTML in these fields through the product editor (rich text / source mode) and stores the value directly in MongoDB without sanitization. When any unauthenticated or authenticated user browses the affected product page, the payload executes automatically.
An authenticated administrator or vendor is able to inject arbitrary JavaScript that executes in the browser of any customer visiting the affected product page, leading to session cookie theft and account takeover.
The advisory was published on 2026-06-24 and rates the issue as High. No patched version is available at this time.
Note on CNA coordination: I am the reporter of this advisory, not a maintainer of the repository. On GitHub only maintainers and owners are able to request a CVE, so I was unable to request one myself. The maintainers have not responded and no CVE has been assigned since publication. The same product has previously received CVE-2025-10216 through VulDB after the vendor did not respond.

• Source: ⚠️ https://github.com/grandnode/grandnode2/security/advisories/GHSA-cvpg-48r9-fq67
• User: sonnt0393 (UID 101174)
• Submission: 09/17/2026 11:19 (1 month ago)
• Moderation: 10/19/2026 14:48 (1 month later)
• Status: Accepted
• VulDB entry: 422323 [grandnode grandnode2 up to 2.3.0 Product Description Product.Layout.Simple.cshtml Html.Raw cross site scripting]
• Points: 20