The flaw is a stored cross‑site scripting weakness in Frappe ERPNext 16.x before 16.27.0. An attacker who has edit rights can set a malicious record name that is rendered without escaping. When another user opens the page containing that record, the injected script runs in that user’s browser context, permitting the attacker to steal data, hijack sessions or execute additional malicious actions.

Any deployment of Frappe ERPNext running a 16.x release older than 16.27.0 is affected. Users who can edit records in these environments are susceptible. The product is identified by Frappe ERPNext and the issue applies to all minor 16.x versions prior to 16.27.0.

The CVSS v3 score of 5.1 places the vulnerability in the medium severity range. No EPSS value is available, and the vulnerability is not listed in CISA KEV, indicating no known large‑scale exploitation at this time. The attack requires authentication and edit privileges, so it is most relevant to trusted users with sufficient permissions. If an attacker can gain edit rights, the vulnerability can be leveraged to execute arbitrary client‑side code in the context of any colleague who views the affected record.