CVE-2026-109653

Deferred Deferred - Pending Action

Stored XSS in Frappe ERPNext

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description

Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a stored cross-site scripting vulnerability because record fields are rendered into an HTML attribute context without escaping. A low-privilege user can store a malicious payload in a record field that executes in the browser of any privileged user who opens the affected page, enabling account takeover.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-12

Generated

2026-10-13

AI Q&A

2026-10-13

EPSS Evaluated

N/A

NVD

CVE-2026-109653

Affected Vendors & Products

Vendor	Product	Version / Range
frappe	erpnext	0
frappe	erpnext	16.0.0-beta.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

Frappe ERPNext versions before 15.119.0 and 16.x before 16.31.0 have a stored cross-site scripting vulnerability. This occurs because record fields are rendered into an HTML attribute context without proper escaping. A low-privilege user can inject malicious code into a record field, which executes in the browser of any privileged user who views the affected page, potentially leading to account takeover.

Detection Guidance

Check ERPNext version with bench version command. Inspect record fields for improper HTML escaping in templates. Look for unusual JavaScript in stored data via database queries.

Impact Analysis

This vulnerability allows attackers to execute malicious scripts in the browsers of privileged users. This could lead to unauthorized access to sensitive data, session hijacking, or complete account takeover for users with elevated permissions.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate GDPR's data protection requirements or HIPAA's privacy and security rules. Organizations using affected versions may face compliance violations, legal penalties, and reputational damage.

Mitigation Strategies

Upgrade to ERPNext 15.119.0 or 16.31.0 or later. Review and sanitize all user-input fields. Implement strict input validation for record fields. Monitor for suspicious stored payloads.

Hi! I’m here to help you understand CVE-2026-109653. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70