CVE-2026-109653: Frappe ERPNext before 15.119.0 Stored XSS Leading to Account Takeover
Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a stored cross-site scripting vulnerability because record fields are rendered into an HTML attribute context without escaping. A low-privilege user can store a malicious payload in a record field that executes in the browser of any privileged user who opens the affected page, enabling account takeover.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Frappe ERPNextto a version that resolves this vulnerability.Fixed in 15.119.0 - Upgrade
Upgrade
Frappe ERPNextto a version that resolves this vulnerability.Fixed in 16.31.0
Event History
Frequently Asked Questions
Which deployments are affected?
Affected versions are ERPNext releases before 15.119.0 and 16.x releases before 16.31.0.
What level of access does an attacker need?
An attacker needs a low-privilege ERPNext account that can store content in a record field. They must also cause a privileged user to open the affected page containing the stored payload.
Is user interaction required for exploitation?
Yes. The stored payload executes when a privileged user opens the affected page in their browser.
What is the likely impact if exploitation succeeds?
The vulnerability can enable takeover of the privileged user's account. The stated impact includes high confidentiality and integrity impact, with no availability impact indicated.