ERPNext versions 15.103.1 and earlier contain a Cross Site Scripting (XSS) vulnerability in the Email Template engine. This flaw allows an attacker with permissions to create or edit email templates to inject malicious JavaScript code. The injected code executes in the browser of users who view or apply the compromised email template, potentially leading to information disclosure or session hijacking.