CVE-2026-48541

Deferred Deferred - Pending Action

Stored XSS in Krayin CRM via Person Name Field

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: VulnCheck

Description

Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the person name field. Attackers can craft a person name containing double-brace template syntax that reaches the Vue template compiler, enabling prototype chain traversal to retrieve the Function constructor and execute attacker-supplied JavaScript in the application origin for every user who views the affected person record.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-24

Last Modified

2026-09-24

Generated

2026-09-25

AI Q&A

2026-09-25

EPSS Evaluated

N/A

NVD

CVE-2026-48541

Affected Vendors & Products

Vendor	Product	Version / Range
krayin	crm	2.2.6

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

Krayin CRM through version 2.2.6 has a stored client-side template injection flaw. Authenticated attackers can inject Vue.js template expressions into the person name field. This allows them to execute arbitrary JavaScript in the browsers of other users who view the affected record.

Detection Guidance

Check for Vue.js template expressions in person name fields of Krayin CRM. Inspect browser console for JavaScript errors when viewing user records. Review server logs for unusual input patterns containing double-brace syntax like {{...}}.

Impact Analysis

If you use Krayin CRM version 2.2.6 or earlier, an attacker with access could inject malicious JavaScript into your CRM data. This could lead to unauthorized actions, data theft, or session hijacking when you view the compromised records.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate GDPR (data protection) and HIPAA (health data privacy) requirements. Organizations using affected versions may face compliance violations and potential fines.

Mitigation Strategies

Upgrade Krayin CRM to the latest version beyond 2.2.6. Implement input validation to block Vue.js template syntax in person name fields. Use Content Security Policy (CSP) headers to restrict inline script execution.

Hi! I’m here to help you understand CVE-2026-48541. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70