CVE-2026-109670: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in frappe erpnext

Frappe ERPNext versions prior to 15.110.0 and 16.x before 16.21.0 contain a stored cross-site scripting vulnerability due to improper neutralization of input during web page generation. Specifically, record names are rendered without escaping, enabling attackers with write permissions on item master data to embed malicious scripts. When other users open the affected pages, the scripts execute in their browsers, potentially leading to unauthorized actions or data exposure within the context of the ERPNext application.

An attacker with write access to item master data can inject malicious scripts into record names. These scripts execute in the browsers of users who view the affected pages, potentially leading to session hijacking, unauthorized actions, or data theft within the ERPNext environment. The vulnerability requires the attacker to have some level of write access, limiting the attack surface. The CVSS score of 5.1 reflects a medium severity impact.

Upgrade to Frappe ERPNext version 15.110.0 or later, or 16.21.0 or later, where this vulnerability is fixed. Patch status is not explicitly stated but the affected versions indicate that these versions include the fix. No vendor advisory content is provided, so check the official ERPNext release notes or security advisories for confirmation and further guidance.