CVE-2026-48542 is a stored client-side template injection vulnerability in Krayin laravel-crm through version 2.2.6. It allows authenticated attackers to inject Vue.js double-brace template syntax into the product name field. This input reaches the Vue template compiler, enabling prototype chain traversal to access the Function constructor and execute arbitrary JavaScript in the context of the application origin for any user viewing the compromised product record. The vulnerability results from improper neutralization of input during web page generation.

An attacker with authentication privileges can execute arbitrary JavaScript code in the browsers of other users who view the affected product record. This can lead to session hijacking, unauthorized actions, or other client-side impacts within the application origin. The CVSS 4.0 base score is 5.1 (medium severity), reflecting network attack vector, low attack complexity, and no required privileges beyond authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to trusted users only and consider sanitizing or validating input fields that accept template expressions to prevent injection. Monitor vendor channels for official patches or updates.