CVE-2026-48542

Deferred Deferred - Pending Action

Stored XSS in Krayin CRM via Product Name Field

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: VulnCheck

Description

Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the product name field. Attackers can craft a product name containing double-brace template syntax that reaches the Vue template compiler, enabling prototype chain traversal to retrieve the Function constructor and execute attacker-supplied JavaScript in the application origin for every user who views the affected product record.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-24

Last Modified

2026-09-24

Generated

2026-09-25

AI Q&A

2026-09-25

EPSS Evaluated

N/A

NVD

CVE-2026-48542

Affected Vendors & Products

Vendor	Product	Version / Range
krayin	crm	2.2.6

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a stored client-side template injection vulnerability in Krayin CRM versions up to 2.2.6. An authenticated attacker can inject Vue.js template expressions into the product name field. When other users view the affected product record, the injected code executes in their browsers, allowing the attacker to run arbitrary JavaScript in the application's context.

Detection Guidance

Check Krayin CRM product name fields for Vue.js template expressions like double braces {{ }}. Inspect browser console for JavaScript errors when viewing product records. Review server logs for suspicious input patterns in product names.

Impact Analysis

If you are a user of Krayin CRM, an attacker could steal your session cookies, perform actions on your behalf, or access sensitive data within the application. For administrators, this could lead to full account compromise or unauthorized access to user data across the system.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR's data protection principles and potentially triggering breach notification requirements. For HIPAA, it may compromise protected health information integrity and confidentiality, risking compliance violations and penalties.

Mitigation Strategies

Upgrade Krayin CRM to the latest version beyond 2.2.6. Sanitize all user inputs, especially product names, to block template expressions. Implement strict input validation for Vue.js template syntax.

Hi! I’m here to help you understand CVE-2026-48542. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70