A server side rendering flaw in GrandNode2 allows insecure content to be injected through the Html.Raw helper in the Product Layout Simple view. The vulnerability results in cross‑site scripting, which permits an attacker to inject malicious scripts that execute in the context of any viewer of the affected product description, violating confidentiality and possibly enabling credential theft or session hijacking. The weakness is a classic input validation failure (CWE‑79).

The issue exists in GrandNode2 versions up to and including 2.3.0. The affected component is the Product Description Handler, specifically the view file src/Web/Grand.Web/Views/Product/Product.Layout.Simple.cshtml. GrandNode, the vendor, has provided an update that resolves the flaw starting with version 2.4.0‑beta (and subsequently 2.4.0).

The flaw has a CVSS score of 4.8, indicating moderate severity. EPSS data is not available, and the vulnerability is currently not listed in the CISA KEV catalog. The attack can be launched remotely by an actor who can influence the product description content entered into the system; once the vulnerable content is stored or displayed, arbitrary JavaScript can be executed in the browsers of any user who views that product page.