CVE-2026-109657: Frappe ERPNext 16.x before 16.27.0 Stored XSS via Unescaped Record Name

Q: Who can exploit this issue, and who is at risk from it?

An attacker needs edit rights that allow them to set a record name. Any colleague who subsequently opens a page rendering that unescaped record name can have script executed in their browser.

Q: Does exploitation require user interaction?

Yes. The attacker must first save a malicious record name, and a victim must open the page where that record name is rendered.

Q: Which ERPNext versions are affected?

ERPNext 16.x releases before 16.27.0 are affected. Version 16.27.0 is not included in the affected range stated here.

Published Oct 12, 2026

Updated

Frappe ERPNext 16.x before 16.27.0 contains a stored cross-site scripting vulnerability that allows users with edit rights to inject script through a record name rendered without escaping. Attackers can set a malicious record name so the script runs in the browser of any colleague who opens the page.

Affected Software

1 affected component

Frappe ERPNext<16.27.0

Event History

Oct 12, 2026

CVE Published

via MITRE·10:22 PM

Data Sourced

via MITRE·10:22 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue, and who is at risk from it?

An attacker needs edit rights that allow them to set a record name. Any colleague who subsequently opens a page rendering that unescaped record name can have script executed in their browser.

Does exploitation require user interaction?

Yes. The attacker must first save a malicious record name, and a victim must open the page where that record name is rendered.

Which ERPNext versions are affected?

ERPNext 16.x releases before 16.27.0 are affected. Version 16.27.0 is not included in the affected range stated here.

CVE-2026-109657: Frappe ERPNext 16.x before 16.27.0 Stored XSS via Unescaped Record Name

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue, and who is at risk from it?

Does exploitation require user interaction?

Which ERPNext versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue, and who is at risk from it?

Does exploitation require user interaction?

Which ERPNext versions are affected?