CVE-2026-48541: Krayin CRM 2.2.6 Stored Template Injection XSS via Contact Name Field
Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the person name field. Attackers can craft a person name containing double-brace template syntax that reaches the Vue template compiler, enabling prototype chain traversal to retrieve the Function constructor and execute attacker-supplied JavaScript in the application origin for every user who views the affected person record.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue and who is exposed to the payload?
An authenticated attacker with permission to create or modify a person name can inject the payload. Any user who subsequently views the affected person record can have attacker-supplied JavaScript execute in their browser under the application origin.
Is user interaction required for exploitation?
The attacker must be authenticated and able to submit a crafted person name. A victim must view the affected person record for the stored payload to execute.
Which versions are identified as affected?
Krayin CRM through version 2.2.6 is identified as affected. The provided information does not identify a fixed version.