CVE-2026-109670: Frappe ERPNext before 15.110.0 Stored XSS via Item Record Name
Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a stored cross-site scripting vulnerability caused by record names being rendered without escaping. Attackers with write access to item master data can store malicious script in a record name that executes in the browser of any operator who opens the affected page.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Affected versions are ERPNext releases before 15.110.0 and 16.x releases before 16.21.0.
What access does an attacker need?
An attacker needs write access to item master data so they can save a malicious script in an item record name. Exploitation also requires an operator to open the page that renders the affected record name.
Who is exposed to the payload?
Any operator whose browser opens an affected page containing the malicious item record name may execute the stored script. The issue is therefore most relevant where users with item-master write permissions are less trusted than users who review or operate on item records.
How can we check for possible compromise or exposure?
Review item master record names for unexpected script-like or HTML content, particularly records created or modified by accounts with item-master write access. Also identify whether operators have opened pages displaying those records.