An authenticated ERPNext user with Item record edit permissions can save arbitrary HTML or JavaScript into the item_name, description, or image fields of an Item. When that item is later added to a POS transaction, the content is rendered unescaped in the cart interface, allowing the attacker to inject scripts that execute in the browser context of any operator who performs the sale. This cross‑site scripting can be used to hijack operator sessions, deface the POS screen, or exfiltrate sensitive data available to the browser.

The vulnerability exists only in ERPNext version 16.16.0 and affects installations on Linux, macOS, and Windows platforms. The product is distributed by the Frappe:ERPNext vendor.

The CVSS score of 4.8 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Likely exploitation requires the attacker to have local authenticated access with edit rights on Item records; no public remote exploitation has been documented. The risk is primarily to operators using the POS interface, who could be compromised by the injected scripts. Given the moderate score and limited attack surface, continuous monitoring and timely patching are recommended.