CVE-2026-109673

Deferred Deferred - Pending Action

Stored XSS in Frappe ERPNext Dashboard Records

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description

Frappe ERPNext before 15.103.0 and 16.x before 16.12.0 contains a stored cross-site scripting vulnerability because the names of certain records are not properly neutralized when rendered on some dashboards, tools, and portals. Authenticated attackers can craft malicious record names that execute scripts in other users' browsers, enabling data access, modification, and token theft, especially against privileged users.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-12

Generated

2026-10-13

AI Q&A

2026-10-13

EPSS Evaluated

N/A

NVD

CVE-2026-109673

Affected Vendors & Products

Vendor	Product	Version / Range
frappe	erpnext	0
frappe	erpnext	16.0.0-beta.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

Frappe ERPNext versions before 15.103.0 and 16.x before 16.12.0 have a stored cross-site scripting (XSS) vulnerability. Attackers with authentication can create malicious record names that execute scripts in other users' browsers when viewed on dashboards, tools, or portals. This allows stealing data, modifying content, or taking over user sessions, particularly targeting privileged accounts.

Detection Guidance

This vulnerability involves stored cross-site scripting in Frappe ERPNext due to improper neutralization of record names. To detect it, inspect user-generated content like document names, especially in dashboards and portals, for suspicious scripts or unusual characters. Check for records with names containing <script> tags or event handlers like onerror. Review server logs for unusual activity in user sessions.

Impact Analysis

If you use Frappe ERPNext versions before 15.103.0 or 16.x before 16.12.0, attackers could steal your session tokens, access sensitive data, or perform actions on your behalf. Privileged users like administrators are at higher risk of data breaches or unauthorized system changes.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's data protection requirements or HIPAA's safeguards for protected health information. Organizations may face compliance penalties, legal liabilities, and reputational damage if exploited.

Mitigation Strategies

Upgrade Frappe ERPNext to version 15.103.0 or later if using version 15.x, or to 16.12.0 or later if using version 16.x. Apply input validation to sanitize record names, escaping HTML and JavaScript characters. Implement a content security policy (CSP) to restrict inline scripts. Monitor user sessions for unauthorized access or data exfiltration.

Hi! I’m here to help you understand CVE-2026-109673. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70