CVE-2025-65924: XSS
ERPNext thru 15.88.1 does not sanitize or remove certain HTML tags specifically <a> hyperlinks in fields that are intended for plain text. Although JavaScript is blocked (preventing XSS), the HTML is still preserved in the generated PDF document. As a result, an attacker can inject malicious clickable links into an ERP-generated PDF. Since PDF files generated by the ERP system are generally considered trustworthy, users are highly likely to click these links, potentially enabling phishing attacks or malware delivery. This issue occurs in the Add Quality Goal' function.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-65924?
CVE-2025-65924 has a high severity due to the potential for phishing attacks via the injected hyperlinks.
How do I fix CVE-2025-65924?
To fix CVE-2025-65924, upgrade ERPNext to version 15.89.0 or later where the HTML sanitization issue has been resolved.
What specific HTML tags are problematic in CVE-2025-65924?
CVE-2025-65924 specifically fails to sanitize `<a>` hyperlink tags in fields meant for plain text.
Can CVE-2025-65924 lead to XSS attacks?
CVE-2025-65924 does not lead to XSS attacks as JavaScript is blocked, but it can still lead to malicious click phishing.
Which versions of ERPNext are affected by CVE-2025-65924?
ERPNext versions up to and including 15.88.1 are affected by CVE-2025-65924.