CVE-2026-109670

Deferred Deferred - Pending Action

Stored XSS in Frappe ERPNext Due to Unescaped Record Names

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description

Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a stored cross-site scripting vulnerability caused by record names being rendered without escaping. Attackers with write access to item master data can store malicious script in a record name that executes in the browser of any operator who opens the affected page.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-12

Generated

2026-10-13

AI Q&A

2026-10-13

EPSS Evaluated

N/A

NVD

CVE-2026-109670

Affected Vendors & Products

Vendor	Product	Version / Range
frappe	erpnext	0
frappe	erpnext	16.0.0-beta.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in Frappe ERPNext versions before 15.110.0 and 16.x before 16.21.0. It occurs because record names are displayed without proper escaping, allowing attackers with write access to insert malicious scripts into record names. These scripts then execute in the browsers of users who view the affected pages.

Detection Guidance

Check ERPNext versions for affected releases (before 15.110.0 or 16.x before 16.21.0). Inspect record names in item master data for suspicious scripts. Review browser console logs for unexpected script executions when viewing records.

Impact Analysis

If you are a user of Frappe ERPNext with write access to item master data, an attacker could exploit this to store malicious scripts in record names. When you or other users open the affected page, the script executes in your browser, potentially stealing session cookies, redirecting you to phishing sites, or performing unauthorized actions on your behalf.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles or HIPAA's security requirements for protected health information. Organizations may face compliance violations, legal penalties, or reputational damage if exploited.

Mitigation Strategies

Upgrade ERPNext to version 15.110.0 or later, or 16.21.0 or later. Sanitize existing record names to remove any malicious scripts. Restrict write access to item master data to trusted users only.

Hi! I’m here to help you understand CVE-2026-109670. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70