CVE-2026-109662: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in frappe erpnext

Frappe ERPNext versions prior to 15.112.0 and 16.x versions before 16.23.0 contain a stored cross-site scripting vulnerability in a public portal form. This form accepts unauthenticated user submissions that are stored and later rendered without proper neutralization of input, allowing attackers to inject malicious scripts. When staff members view the stored records, the injected scripts execute in their browsers, potentially leading to unauthorized actions or data exposure within the staff session context.

An unauthenticated attacker can submit crafted markup to a public portal form, which is stored and later rendered in the browsers of staff members who review the records. This can lead to execution of arbitrary scripts in the context of staff users, potentially compromising their session or performing unauthorized actions. The vulnerability is rated medium severity with a CVSS score of 5.3, indicating a moderate risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the public portal form if possible or implement input validation and output encoding controls on the affected form to mitigate the risk of stored XSS.