CVE-2026-38432 is a Cross Site Scripting (XSS) vulnerability affecting ERPNext up to version 15.103.1. The vulnerability resides in the Email Template engine, where an attacker with the ability to create or modify email templates can insert malicious JavaScript code. When the template is rendered in a victim's browser, the script executes, potentially leading to client-side code execution. The CVSS 3.1 base score is 6.1 (medium), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity with no impact on availability. There is no vendor advisory or patch information available at this time.

An attacker who can create or edit email templates can inject malicious scripts that execute in users' browsers when the template is applied. This can lead to client-side code execution impacting confidentiality and integrity of user data within the browser context. There is no indication of direct impact on system availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict permissions to create or edit email templates to trusted users only to reduce risk of exploitation.