CVE-2026-109657: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in frappe erpnext

Frappe ERPNext versions >=16.0.0-beta.1 and <16.27.0 contain a stored cross-site scripting vulnerability due to improper neutralization of input during web page generation. Specifically, record names are rendered without escaping, enabling users with edit permissions to inject malicious scripts. These scripts execute in the browsers of colleagues who open the affected pages, potentially leading to unauthorized script execution within the application context.

The vulnerability allows an attacker with edit rights to inject arbitrary scripts that execute in the browsers of other users viewing the affected record. This can lead to session hijacking, unauthorized actions, or other malicious behaviors within the context of the ERPNext application. However, exploitation requires the attacker to have edit permissions, and user interaction (viewing the page) is necessary.

An official fix is available in ERPNext version 16.27.0 and later. Users should upgrade to version 16.27.0 or newer to remediate this vulnerability. There is no indication that the vulnerability is mitigated by default or that no action is required.