CVE-2026-109604: ERPNext before 15.112.0 Stored XSS via Tool View Record Names
Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a stored cross-site scripting vulnerability because a tool view interpolates stored record names into markup without escaping. An authenticated user able to create such records can give them malicious names, executing script in the session of any user who later opens that tool.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Affected releases are ERPNext versions before 15.112.0 and 16.x versions before 16.23.0.
What access does an attacker need?
An attacker must be authenticated and have permission to create records whose names are displayed by the vulnerable tool view. They can store malicious script in a record name for later execution.
When does the malicious script execute?
Execution requires a user to open the affected tool view containing the maliciously named record. This requires user interaction, but the viewing user does not need to create or modify the malicious record.
What is the potential impact?
The script executes in the session of the user who opens the tool view. The provided severity vector indicates high confidentiality and integrity impact, with no availability impact.