CVE-2026-109612: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in frappe erpnext

Frappe ERPNext versions prior to 15.120.0 and 16.x prior to 16.33.0 contain a stored XSS vulnerability in a report view. This flaw arises because stored record names are interpolated into HTML markup without escaping, allowing an authenticated user with record creation privileges to inject malicious scripts. When other users open the affected report, the injected script executes in their session context, potentially leading to session hijacking or other script-based attacks.

An attacker with authenticated access and record creation rights can inject malicious scripts that execute in the browsers of users who view the affected report. This can lead to session hijacking, unauthorized actions performed on behalf of the victim, or other impacts typical of stored XSS vulnerabilities. The CVSS 4.0 score is 8.5 (high severity), reflecting the network attack vector, low attack complexity, and high impact on confidentiality and integrity.

A fix is available in Frappe ERPNext versions 15.120.0 and 16.33.0 and later. Users should upgrade to these versions to remediate the vulnerability. No vendor advisory content was provided to indicate alternative mitigations or temporary workarounds. Patch status is confirmed by the affected version ranges.