CVE-2026-53575
Deferred Deferred - Pending Action

Authenticated JavaScript Injection in EspoCRM via CSP Nonce

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description
EspoCRM is an open source customer relationship management application. Prior to 9.3.9, an authenticated administrator can place crafted content in the applicationName setting through CSP nonce injection. The persistent injection is inserted into the main application page without escaping, allowing attacker-controlled JavaScript to run in users' sessions and leak page data, including unsaved user input. This issue is fixed in version 9.3.9.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-15
AI Q&A
2026-10-15
EPSS Evaluated
N/A
NVD
CVE-2026-53575
EUVD
EUVD-2026-102103

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
espocrm espocrm < 9.3.9

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Persistent Cross-Site Scripting (XSS) vulnerability in EspoCRM versions 9.3.8 and earlier. An authenticated administrator can inject crafted JavaScript into the applicationName setting via CSP nonce injection. The injected script is stored persistently and rendered unsafely in the main application page, allowing attacker-controlled JavaScript to execute in users' sessions and steal page data, including unsaved user input.

Detection Guidance

Check EspoCRM version with: grep -r "version" /path/to/espocrm/config.php. If version is 9.3.8 or earlier, the system is vulnerable. Inspect applicationName settings in the database for unexpected JavaScript or special characters.

Impact Analysis

An attacker with admin access could steal sensitive data from users' sessions, such as unsaved form inputs or other page content. This could lead to unauthorized data access, session hijacking, or further exploitation depending on the stolen data.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, potentially violating GDPR (data protection) and HIPAA (health information privacy) requirements. Organizations using vulnerable versions may face compliance risks if user data is compromised.

Mitigation Strategies

Upgrade EspoCRM to version 9.3.9 or later immediately. Review applicationName settings for unauthorized scripts. Apply input sanitization to all user-controlled fields.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-53575. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart