CVE-2026-48543

Deferred Deferred - Pending Action

Stored XSS in Krayin CRM via Vue.js Template Injection

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: VulnCheck

Description

Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the web form description field. Attackers can craft a web form description containing double-brace template syntax that reaches the Vue template compiler, enabling prototype chain traversal to retrieve the Function constructor and execute attacker-supplied JavaScript in the application origin for every user who views the affected web form.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-24

Last Modified

2026-09-24

Generated

2026-09-25

AI Q&A

2026-09-25

EPSS Evaluated

N/A

NVD

CVE-2026-48543

Affected Vendors & Products

Vendor	Product	Version / Range
krayin	crm	to 2.2.6 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

Krayin CRM through 2.2.6 has a stored client-side template injection flaw. Authenticated attackers can inject Vue.js template expressions into the web form description field. This allows them to execute arbitrary JavaScript in other users' browsers when they view the affected form. The attack uses double-brace template syntax to reach the Vue template compiler and perform prototype chain traversal to access the Function constructor.

Detection Guidance

To detect this vulnerability, inspect web forms in Krayin CRM for injected Vue.js template expressions in description fields. Look for double-brace syntax like {{...}} or expressions that traverse the prototype chain (e.g., {{constructor.constructor('alert(1)')()}}). Check server logs for unusual JavaScript execution patterns or unauthorized data access.

Impact Analysis

This vulnerability allows attackers to run malicious JavaScript in your browser when you view a compromised web form. This could lead to session hijacking, data theft, or unauthorized actions on your behalf within the application. Attackers could steal sensitive data, perform actions as you, or spread malware to other users.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR and HIPAA requirements for data protection and access controls. It may result in data breaches, non-compliance with security obligations, and potential legal penalties due to compromised user data.

Mitigation Strategies

Immediately update Krayin CRM to the latest version beyond 2.2.6. If an update is unavailable, disable or restrict access to the description field in web forms. Implement input validation to block Vue.js template syntax. Use Content Security Policy (CSP) headers to mitigate JavaScript execution risks.

Hi! I’m here to help you understand CVE-2026-48543. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70