The vulnerability allows an attacker who can create or edit email templates to insert malicious JavaScript code that executes on the victim’s browser when the template is rendered. This client‑side XSS flaw originates from unsanitized template rendering in ERPNext’s email template engine.

ERPNext releases up to and including version 15.103.1 are affected. Any installation that uses the built‑in email template editor and grants users the ability to create or edit templates is vulnerable.

Exploitation requires the attacker to have permission to edit email templates, typically meaning the attacker must have administrative or privileged access. No EPSS score is available, and the vulnerability is not listed in CISA KEV, indicating no confirmed widespread exploitation. Because it is a client‑side XSS, it can lead to malicious script execution within the victim’s browser during email template rendering.