CVE-2026-109657: Frappe ERPNext 16.x before 16.27.0 Stored XSS via Unescaped Record Name
Published Oct 12, 2026
·Updated
Frappe ERPNext 16.x before 16.27.0 contains a stored cross-site scripting vulnerability that allows users with edit rights to inject script through a record name rendered without escaping. Attackers can set a malicious record name so the script runs in the browser of any colleague who opens the page.
Affected Software
1 affected component
Frappe ERPNext<16.27.0
Event History
Oct 12, 2026
CVE Published
via MITRE·10:22 PM
Data Sourced
via MITRE·10:22 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·11:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue, and who is at risk from it?
An attacker needs edit rights that allow them to set a record name. Any colleague who subsequently opens a page rendering that unescaped record name can have script executed in their browser.
2
Does exploitation require user interaction?
Yes. The attacker must first save a malicious record name, and a victim must open the page where that record name is rendered.
3
Which ERPNext versions are affected?
ERPNext 16.x releases before 16.27.0 are affected. Version 16.27.0 is not included in the affected range stated here.