CVE-2026-48542: Krayin CRM 2.2.6 Stored Template Injection XSS via Product Name Field
Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the product name field. Attackers can craft a product name containing double-brace template syntax that reaches the Vue template compiler, enabling prototype chain traversal to retrieve the Function constructor and execute attacker-supplied JavaScript in the application origin for every user who views the affected product record.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attacker must be authenticated and able to set a product name. Exploitation requires placing Vue.js double-brace template syntax in that field.
Who can be impacted once a malicious product name has been saved?
Any user who views the affected product record can have attacker-supplied JavaScript executed in their browser under the application origin. The issue is stored, so the attacker does not need to interact with each victim after saving the product record.
Which releases are in scope?
Krayin CRM versions through 2.2.6 are identified as affected.