CVE-2026-48542

Krayin CRM 2.2.6 Stored Template Injection XSS via Product Name Field

Published Sep 24, 2026 CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Description

Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the product name field. Attackers can craft a product name containing double-brace template syntax that reaches the Vue template compiler, enabling prototype chain traversal to retrieve the Function constructor and execute attacker-supplied JavaScript in the application origin for every user who views the affected product record.

Analysis

Technical impact

Krayin CRM through version 2.2.6 allows an authenticated user to insert Vue.js template expressions into the product name field, creating a stored client‑side template injection vulnerability. The injected expression can traverse the prototype chain to obtain the Function constructor and run arbitrary JavaScript within the context of any browser viewing the product record. This results in cross‑site scripting that can be used to steal session cookies, deface pages, or perform further client‑side attacks.

Affected Systems

The vulnerability affects Krayin CRM version 2.2.6, with the relevant product being the Laravel‑CRM application sold by Krayin. No other versions are explicitly noted as affected.

Risk and Exploitability

The CVSS score of 5.1 indicates moderate severity. The EPSS score is not available, and the flaw is not listed in CISA's KEV catalog. The attack requires an authenticated user to create or edit a product name, after which any user who views that product is impacted. Because it is a client‑side issue, the potential impact is limited to the victim’s browser, but the exploit can still lead to credential theft and session hijacking. Overall, the risk is moderate with a realistic chance of exploitation in environments where authentication is weak or internal users are used maliciously.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

krayin

laravel-crm

unknown

Version	Status	Constraints
`0`	affected	≤ 2.2.6

No data.

Vendor Product Versions

Krayin

Laravel-crm

Version	Status	Scheme	Platform
`[0,2.2.6]`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the vendor’s patch or upgrade Krayin CRM to a version that removes the template injection flaw.
If a patch is unavailable, restrict or remove editing privileges for the product name field from non‑admin users, and enforce plain‑text input to block double‑brace syntax.
Implement a strong content‑security‑policy header to limit the execution of unintended scripts.
Verify that all client‑side templates perform proper escaping or rendering guardrails before rendering user input.

Generated by OpenCVE AI on September 25, 2026 at 03:50 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact Low

Subsequent System Integrity Impact Low

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.172% probability within 30 days)

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/aaronamran/CVE-Disclosures/tree/main/CVE-2026/CVE-2026-48541
https://www.vulncheck.com/advisories/krayin-crm-stored-template-injection-xss-via-product-name-field

History

Sep 29, 2026 4:15 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 25, 2026 8:30 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Krayin Krayin laravel-crm
Vendors & Products		Krayin Krayin laravel-crm

Sep 24, 2026 7:45 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the product name field. Attackers can craft a product name containing double-brace template syntax that reaches the Vue template compiler, enabling prototype chain traversal to retrieve the Function constructor and execute attacker-supplied JavaScript in the application origin for every user who views the affected product record.
Title		Krayin CRM 2.2.6 Stored Template Injection XSS via Product Name Field
Weaknesses		CWE-79
References		https://github.com/aaronamran/CVE-Disclosures/tree/main/CVE-2026/CVE-2026-48541 https://www.vulncheck.com/advisories/krayin-crm-stored-template-injection-xss-via-product-name-field
Metrics		cvssV3_1 `{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N'}` cvssV4_0 `{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N'}`