CVE-2026-109673: Frappe ERPNext before 16.12.0 Stored XSS via Crafted Record Names
Frappe ERPNext before 15.103.0 and 16.x before 16.12.0 contains a stored cross-site scripting vulnerability because the names of certain records are not properly neutralized when rendered on some dashboards, tools, and portals. Authenticated attackers can craft malicious record names that execute scripts in other users' browsers, enabling data access, modification, and token theft, especially against privileged users.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Frappe ERPNextto a version that resolves this vulnerability.Fixed in 15.103.0 - Upgrade
Upgrade
Frappe ERPNextto a version that resolves this vulnerability.Fixed in 16.12.0
Event History
Frequently Asked Questions
Which ERPNext versions are affected?
ERPNext versions before 15.103.0 are affected, as are 16.x versions before 16.12.0.
Does an attacker need access to ERPNext to exploit this issue?
Yes. Exploitation requires an authenticated attacker who can create specially crafted names for certain records.
What must happen for the malicious script to run?
A user must view a location that renders the crafted record name, such as an affected dashboard, tool, or portal. The attack is especially consequential when the viewing user has elevated privileges.
What could an attacker gain through a successful exploit?
The injected script can access or modify data in the victim's browser context and steal tokens. Availability impact is not indicated.