The vulnerability lies in the way the ERPNext report view renders stored record names. Record names are inserted directly into HTML markup without any escaping, allowing an attacker who can create or modify records to inject JavaScript. When a user opens the affected report, the injected script runs in the context of that user's browser, providing the attacker with the same level of access as the victim. This can lead to session hijacking, credential theft, or other malicious actions carried out on behalf of the user.

Frappe ERPNext editions running before 15.120.0 and the 16.x series before 16.33.0 are impacted. Products affected include all installations that provide the default report‑view functionality where record names are displayed. The weakness exists for any instance that has the standard report‑view feature enabled. No additional third‑party applications are known to be affected.

The CVSS score of 8.5 classifies the issue as high severity, and the vulnerability is available as a stored XSS that requires authentication but does not need elevated privileges. Because the EPSS score is not reported and the vulnerability is not listed in CISA's KEV catalog, the current exploitation probability appears low, but the impact is significant if exploitation succeeds. An attacker who can create or update records in the system can inject malicious code that will execute whenever any user views the affected report, potentially compromising confidential data or session integrity. The weakness, classified as CWE‑79, is typically exploited by leveraging the authenticated user's context to bypass browser Same‑Origin Policy protections.