Description
Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a stored cross-site scripting vulnerability because a tool view interpolates stored record names into markup without escaping. An authenticated user able to create such records can give them malicious names, executing script in the session of any user who later opens that tool.
Published: 2026-10-12
Score: 8.5 High
EPSS: n/a
KEV: No
Impact: Stored Cross‑Site Scripting
Action: Apply Patch
AI Analysis

Impact

A stored cross‑site scripting flaw exists in the tool view of Frappe ERPNext.

Affected Systems

ERPNext systems from the frappe vendor, specifically versions prior to 15.112.0 and 16.x versions earlier than 16.23.0.

Risk and Exploitability

The vulnerability carries a CVSS score of 8.5 and is not currently in the CISA KEV catalog. Although the EPSS score is not available, the flaw requires an authenticated user to create a tool view record with a malicious name. Once such a record is stored, any subsequent user who opens that tool view will execute the injected script in their own browser session, potentially allowing session hijacking, data theft, or other client‑side attacks.

Generated by OpenCVE AI on October 12, 2026 at 23:50 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade ERPNext to version 15.112.0 or later, or to 16.23.0 or later, to apply the official fix that escapes record names in tool view markup.
  • Restrict the ability to create or modify tool view records to trusted administrative accounts, and consider removing or sanitizing any existing records with suspicious names.
  • After applying the patch, review existing record names in the database and delete or correct any that could potentially contain unsafe input, ensuring that no malicious scripts remain in stored data.

Generated by OpenCVE AI on October 12, 2026 at 23:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 12 Oct 2026 22:45:00 +0000

Type Values Removed Values Added
Description Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a stored cross-site scripting vulnerability because a tool view interpolates stored record names into markup without escaping. An authenticated user able to create such records can give them malicious names, executing script in the session of any user who later opens that tool.
Title ERPNext before 15.112.0 Stored XSS via Tool View Record Names
First Time appeared Frappe
Frappe erpnext
Weaknesses CWE-79
CPEs cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*
Vendors & Products Frappe
Frappe erpnext
References
Metrics cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N'}

cvssV4_0

{'score': 8.5, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Frappe Erpnext
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-12T22:21:56.499Z

Reserved: 2026-10-12T20:59:18.910Z

Link: CVE-2026-109604

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-10-12T23:17:24.327

Modified: 2026-10-12T23:17:24.447

Link: CVE-2026-109604

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T00:30:17Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')