CVE-2026-42839: ERPNext 16.16.0 - Stored XSS in POS cart item rendering
An authenticated ERPNext user with Item record edit permissions can persist arbitrary HTML/JavaScript in the itemname, description, or image fields of an Item and trigger unescaped rendering in the Point of Sale (POS) cart interface for every operator who adds that item to a transaction.This issue affects ERPNext: 16.16.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Remove or revoke Item record edit permissions from users who do not require them for their role; restrict assignment of this permission to administrators or trusted operators only.
ERPNext Item record edit permissions = restrict to trusted/administrative users - Operational
Audit Item records (item_name, description, image fields) for embedded HTML/JavaScript and remove or sanitize any suspicious or unexpected content. After sanitization, clear relevant caches and restart POS services if required.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-42839?
The severity of CVE-2026-42839 is rated as 50.
How do I mitigate CVE-2026-42839?
Mitigation for CVE-2026-42839 involves sanitizing user input to prevent unescaped HTML/JavaScript in item fields.
Who is affected by CVE-2026-42839?
CVE-2026-42839 affects authenticated ERPNext users with Item record edit permissions.
What type of vulnerability is CVE-2026-42839?
CVE-2026-42839 is a Stored Cross-Site Scripting (XSS) vulnerability.
In which software does CVE-2026-42839 exist?
CVE-2026-42839 exists in the ERPNext 16.16.0 version of the Frappe ERPNext software.