CVE-2026-42840: ERPNext 16.16.0 - Stored XSS in POS customer section via unescaped template literals
An authenticated user can persist arbitrary HTML/JavaScript in the emailid or mobileno fields of a Customer record and trigger unescaped rendering in the Point of Sale (POS) interface for every operator who selects that customer. This issue affects ERPNext: 16.16.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Sanitize and/or escape HTML and JavaScript in the Customer.email_id and Customer.mobile_no fields on input and ensure values are properly escaped before rendering in the Point of Sale (POS) interface to prevent stored XSS.
ERPNext (Customer / POS rendering) email_id and mobile_no input/output handling = escape or strip HTML/JavaScript - Compensating control
Restrict which authenticated users/roles can create or update Customer records (or specifically the email_id and mobile_no fields) to a minimal set of trusted administrators to reduce ability for untrusted users to persist malicious content.
- Compensating control
Limit access to the POS interface to trusted operator networks and consider deploying web-application protections (CSP, WAF rules, or reverse-proxy filtering) to block or mitigate inline scripts and known malicious payloads until a code fix is available.
- Operational
Search existing Customer records for malicious or unexpected HTML/JavaScript in the email_id and mobile_no fields and remove or sanitize any found entries in the database and POS caches.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-42840?
CVE-2026-42840 has a risk rating of 40.
How do I fix CVE-2026-42840?
To fix CVE-2026-42840, ensure proper input validation and escaping for the email_id and mobile_no fields in the Customer record.
Who is affected by CVE-2026-42840?
CVE-2026-42840 affects users of ERPNext version 16.16.0 who interact with the POS customer section.
What type of vulnerability is CVE-2026-42840?
CVE-2026-42840 is a Stored Cross-Site Scripting (XSS) vulnerability.
What impact does CVE-2026-42840 have on users?
CVE-2026-42840 allows an authenticated user to persist malicious code that executes in the POS interface for all operators who select the affected customer.