CVE-2026-109604: ERPNext before 15.112.0 Stored XSS via Tool View Record Names

Q: Which deployments are affected?

Affected releases are ERPNext versions before 15.112.0 and 16.x versions before 16.23.0.

Q: What access does an attacker need?

An attacker must be authenticated and have permission to create records whose names are displayed by the vulnerable tool view. They can store malicious script in a record name for later execution.

Q: When does the malicious script execute?

Execution requires a user to open the affected tool view containing the maliciously named record. This requires user interaction, but the viewing user does not need to create or modify the malicious record.

Q: What is the potential impact?

The script executes in the session of the user who opens the tool view. The provided severity vector indicates high confidentiality and integrity impact, with no availability impact.

Published Oct 12, 2026

Updated

Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a stored cross-site scripting vulnerability because a tool view interpolates stored record names into markup without escaping. An authenticated user able to create such records can give them malicious names, executing script in the session of any user who later opens that tool.

Affected Software

1 affected component

Frappe ERPNext<15.112.0, >=16.0.0<16.23.0

Event History

Oct 12, 2026

CVE Published

via MITRE·10:21 PM

Data Sourced

via MITRE·10:21 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·11:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Affected releases are ERPNext versions before 15.112.0 and 16.x versions before 16.23.0.

What access does an attacker need?

An attacker must be authenticated and have permission to create records whose names are displayed by the vulnerable tool view. They can store malicious script in a record name for later execution.

When does the malicious script execute?

Execution requires a user to open the affected tool view containing the maliciously named record. This requires user interaction, but the viewing user does not need to create or modify the malicious record.

What is the potential impact?

The script executes in the session of the user who opens the tool view. The provided severity vector indicates high confidentiality and integrity impact, with no availability impact.

CVE-2026-109604: ERPNext before 15.112.0 Stored XSS via Tool View Record Names

Affected Software

Event History

Frequently Asked Questions

Which deployments are affected?

What access does an attacker need?

When does the malicious script execute?

What is the potential impact?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What access does an attacker need?

When does the malicious script execute?

What is the potential impact?