CVE-2026-109604

Deferred Deferred - Pending Action

Stored XSS in Frappe ERPNext

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description

Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a stored cross-site scripting vulnerability because a tool view interpolates stored record names into markup without escaping. An authenticated user able to create such records can give them malicious names, executing script in the session of any user who later opens that tool.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-12

Generated

2026-10-13

AI Q&A

2026-10-13

EPSS Evaluated

N/A

NVD

CVE-2026-109604

Affected Vendors & Products

Vendor	Product	Version / Range
frappe	erpnext	0
frappe	erpnext	16.0.0-beta.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

Frappe ERPNext before versions 15.112.0 and 16.x before 16.23.0 has a stored cross-site scripting vulnerability. It occurs because a tool view inserts stored record names into HTML markup without proper escaping. An authenticated user can create records with malicious names that execute scripts when viewed by other users.

Detection Guidance

Check for records with malicious names in Frappe ERPNext tool views. Inspect user-generated content for script tags or unusual characters in record names. Review server logs for unexpected script execution patterns.

Impact Analysis

An attacker with access could inject malicious scripts into record names. When other users view these records, the scripts execute in their sessions, potentially stealing session cookies, performing actions on their behalf, or redirecting them to phishing sites.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles or HIPAA's safeguards for protected health information. Organizations may face compliance breaches if user data is compromised through this exploit.

Mitigation Strategies

Upgrade Frappe ERPNext to version 15.112.0 or later for the 15.x branch, or 16.23.0 or later for the 16.x branch. Remove or rename any suspicious records with script-like names. Implement input validation to prevent XSS in record names.

Hi! I’m here to help you understand CVE-2026-109604. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70