CVE-2026-109612: Frappe ERPNext before 15.120.0 Stored XSS via Report View
Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a stored cross-site scripting vulnerability in a report view that interpolates stored record names into markup without escaping. Authenticated users able to create records can store crafted record names that execute script in the session of any user who later opens the report.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
ERPNext versions before 15.120.0 are affected, as are 16.x versions before 16.33.0. The issue is in a report view that renders stored record names into markup without escaping.
What access does an attacker need to exploit this?
An attacker needs an authenticated account with permission to create records. They must be able to save a crafted record name and rely on another user opening the affected report.
Who is exposed to the malicious script?
Any user who later opens the report containing the crafted record name may execute the attacker-controlled script in their authenticated session. The impact includes high confidentiality and integrity consequences.