CVE-2026-109604: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in frappe erpnext
Description
CVE-2026-109604 is a stored cross-site scripting (XSS) vulnerability in Frappe ERPNext. Versions before 15.112.0 and 16.x before 16.23.0 are affected. The flaw arises because a tool view interpolates stored record names into web page markup without proper escaping. An authenticated user who can create records with malicious names can execute scripts in the sessions of users who later view those records. This vulnerability has a high severity score of 8.5.
CVSS v4.0
Score 8.5high
Affected software
frappe
erpnext
pkg:github/frappe/erpnextRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Frappe ERPNext versions prior to 15.112.0 and 16.x prior to 16.23.0 contain a stored cross-site scripting vulnerability. The issue occurs because a tool view directly inserts stored record names into HTML markup without escaping, allowing an authenticated user to create records with malicious names that execute arbitrary scripts in the context of other users viewing that tool. This can lead to session hijacking or other script-based attacks within the ERPNext application.
Potential Impact
Successful exploitation allows an authenticated user to execute arbitrary scripts in the browser sessions of other users who view the affected tool. This can lead to session hijacking, unauthorized actions, or data theft within the ERPNext environment. The vulnerability requires authentication and user interaction (viewing the malicious record).
Mitigation Recommendations
Upgrade Frappe ERPNext to version 15.112.0 or later, or 16.23.0 or later, where this vulnerability is fixed. No other mitigation or temporary workaround is provided in the available data. Patch status is confirmed by the affected version ranges indicating fixed versions.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-12T20:59:18.910Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6acd63de2cdf04f656e1e417
Added to database: 10/12/2026, 22:49:02 UTC
Last enriched: 10/12/2026, 23:49:17 UTC
Last updated: 10/13/2026, 01:48:16 UTC
Views: 1
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.