CVE-2026-109673: Frappe ERPNext before 16.12.0 Stored XSS via Crafted Record Names

Q: Which ERPNext versions are affected?

ERPNext versions before 15.103.0 are affected, as are 16.x versions before 16.12.0.

Q: Does an attacker need access to ERPNext to exploit this issue?

Yes. Exploitation requires an authenticated attacker who can create specially crafted names for certain records.

Q: What must happen for the malicious script to run?

A user must view a location that renders the crafted record name, such as an affected dashboard, tool, or portal. The attack is especially consequential when the viewing user has elevated privileges.

Q: What could an attacker gain through a successful exploit?

The injected script can access or modify data in the victim's browser context and steal tokens. Availability impact is not indicated.

Published Oct 12, 2026

Updated

Frappe ERPNext before 15.103.0 and 16.x before 16.12.0 contains a stored cross-site scripting vulnerability because the names of certain records are not properly neutralized when rendered on some dashboards, tools, and portals. Authenticated attackers can craft malicious record names that execute scripts in other users' browsers, enabling data access, modification, and token theft, especially against privileged users.

Affected Software

1 affected component

Frappe ERPNext<15.103.0, >=16.0.0<16.12.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Frappe ERPNext to a version that resolves this vulnerability.
Fixed in 15.103.0
Upgrade
Upgrade Frappe ERPNext to a version that resolves this vulnerability.
Fixed in 16.12.0

Event History

Oct 12, 2026

CVE Published

via MITRE·10:22 PM

Data Sourced

via MITRE·10:22 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·11:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which ERPNext versions are affected?

ERPNext versions before 15.103.0 are affected, as are 16.x versions before 16.12.0.

Does an attacker need access to ERPNext to exploit this issue?

Yes. Exploitation requires an authenticated attacker who can create specially crafted names for certain records.

What must happen for the malicious script to run?

A user must view a location that renders the crafted record name, such as an affected dashboard, tool, or portal. The attack is especially consequential when the viewing user has elevated privileges.

What could an attacker gain through a successful exploit?

The injected script can access or modify data in the victim's browser context and steal tokens. Availability impact is not indicated.

CVE-2026-109673: Frappe ERPNext before 16.12.0 Stored XSS via Crafted Record Names

Affected Software

Remediation

Event History

Frequently Asked Questions

Which ERPNext versions are affected?

Does an attacker need access to ERPNext to exploit this issue?

What must happen for the malicious script to run?

What could an attacker gain through a successful exploit?

Company

Resources

Contact

Frequently Asked Questions

Which ERPNext versions are affected?

Does an attacker need access to ERPNext to exploit this issue?

What must happen for the malicious script to run?

What could an attacker gain through a successful exploit?