Krayin CRM through version 2.2.6 contains a stored client‑side template injection vulnerability that allows an authenticated attacker to embed Vue.js double‑brace template syntax into the lead title field. When a user later views the lead record, the Vue template compiler processes the injected syntax, enabling prototype chain traversal to obtain the Function constructor and execute attacker‑supplied JavaScript in the application origin, thereby facilitating arbitrary script execution in other users’ browsers.

The affected product is Krayin CRM, built on the Laravel framework, specifically version 2.2.6. No other versions or editions are listed as impacted in the provided data.

The vulnerability has a CVSS base score of 5.1, indicating a moderate level of severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a valid authenticated session with permission to create or edit leads; attackers craft a malicious lead title containing Vue template expressions. Once another user loads the affected lead, the injected script runs under the application’s origin, which could lead to credential theft, session hijacking, or malicious data manipulation. The lack of a public EPSS score suggests limited known exploitation, but the existence of an attacker‑controlled authenticated session and a moderate CVSS score raise concerns for organizations that permit widespread lead creation/editing privileges.