CVE-2026-38432: XSS
ERPNext v15.103.1 and before is vulnerable to Cross Site Scripting (XSS) in the Email Template engine. An attacker with permission to create or edit email templates can inject malicious JavaScript code that are executed on the victim's browser when the template is applied.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-38432?
CVE-2026-38432 is considered a medium severity vulnerability due to its potential impact on users through Cross Site Scripting (XSS).
How do I fix CVE-2026-38432?
To fix CVE-2026-38432, update your ERPNext installation to version 15.103.2 or later, which addresses the XSS vulnerability.
Who is affected by CVE-2026-38432?
CVE-2026-38432 affects users of ERPNext version 15.103.1 and prior versions who have permission to create or edit email templates.
What type of vulnerability is CVE-2026-38432?
CVE-2026-38432 is a Cross Site Scripting (XSS) vulnerability that allows attackers to inject malicious JavaScript into email templates.
Can attackers exploit CVE-2026-38432 remotely?
Yes, attackers can exploit CVE-2026-38432 remotely if they have permissions to create or edit email templates in the affected ERPNext installations.