CVE-2026-48543: Krayin CRM 2.2.6 Stored Template Injection XSS via Web Form Description
Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the web form description field. Attackers can craft a web form description containing double-brace template syntax that reaches the Vue template compiler, enabling prototype chain traversal to retrieve the Function constructor and execute attacker-supplied JavaScript in the application origin for every user who views the affected web form.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue and who is exposed to the injected code?
An attacker needs an authenticated account and the ability to set a web form description. The injected JavaScript executes in the application origin in the browsers of users who view the affected web form.
What interaction is required for exploitation?
The attacker must submit a crafted web form description containing Vue.js double-brace template syntax. A victim must then view the affected web form for the stored payload to execute.
What versions are identified as affected?
Krayin CRM through version 2.2.6 is identified as affected. The provided information does not identify a fixed version.