Frappe ERPNext versions before 15.110.0 and 16.x before 16.21.0 store item record names directly into the page without escaping. An attacker who can write to the item master data can embed a JavaScript payload into a record name. When an operator opens that page the script executes in the operator’s browser, potentially allowing session hijacking, credential theft, or other client‑side attacks. The flaw is a stored cross‑site scripting vulnerability (CWE‑79).

The affected product is Frappe ERPNext. Administrators should check the installed version; if the running instance is any version prior to 15.110.0 or any 16.x release before 16.21.0 it is vulnerable.

The CVSS score of 5.1 indicates a moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to have write privileges on item master data, meaning this is best suited for insiders or compromised accounts with such access. Once a malicious item record name is stored, any user who views that page will be impacted without additional conditions.