CVE-2026-109653 in ERPNext
Summary
by MITRE • 10/13/2026
Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a stored cross-site scripting vulnerability because record fields are rendered into an HTML attribute context without escaping. A low-privilege user can store a malicious payload in a record field that executes in the browser of any privileged user who opens the affected page, enabling account takeover.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/13/2026
The identified security flaw resides within Frappe ERPNext versions prior to 15.119.0 and version 16.x prior to 16.31.0, representing a critical stored cross-site scripting vulnerability that stems from improper input validation and output encoding mechanisms. The core technical deficiency lies in the application's handling of record fields during rendering processes. Specifically, user-supplied data entered into these fields is injected directly into HTML attribute contexts without adequate escaping or sanitization. This architectural oversight allows malicious scripts to be persisted within the database rather than being executed transiently through URL parameters or form submissions that are cleared after a single request cycle. The persistence of this payload means that the vulnerability does not require repeated exploitation attempts by an attacker; instead, it remains dormant until triggered by another user interaction.
From an operational perspective, this vulnerability creates a severe privilege escalation pathway within the ERPNext environment. An attacker with low-privilege access can craft and store a malicious JavaScript payload in any record field that is subsequently rendered into an HTML attribute on pages viewed by higher-privileged users. When a privileged administrator or user navigates to a page containing these tainted records, their browser parses the unescaped content as executable code rather than static data. This execution context allows the attacker's script to run with the same permissions and session cookies as the victim user. The consequences of this execution are profound, primarily enabling account takeover scenarios where the attacker can impersonate legitimate users, access sensitive business data, modify critical records, or perform actions that should be restricted by role-based access controls.
This vulnerability aligns closely with Common Weakness Enumeration identifier CWE-79, which classifies improper neutralization of input during web page generation as a cross-site scripting flaw. Furthermore, the exploitation technique maps to MITRE ATT&CK tactic T1059, specifically subtechnique 007 for JavaScript execution, and falls under the initial access or persistence categories depending on whether the stored payload is used immediately or maintained for future use. The lack of context-aware output encoding in HTML attributes is a classic implementation error that bypasses standard browser security models designed to separate code from data.
To mitigate this risk, immediate patching to Frappe ERPNext version 15.119.0 or later, and version 16.31.0 or later for the 16.x branch, is required as these versions contain the necessary fixes for input sanitization and output encoding. In environments where upgrading is not immediately feasible, administrators should implement strict Content Security Policy headers to restrict script execution sources and disable inline scripts if possible. Additionally, implementing server-side validation that rejects non-essential special characters in record fields can provide a layer of defense-in-depth. Regular security audits focusing on how user input flows into HTML templates are essential to identify similar patterns across the application codebase before they can be exploited by malicious actors seeking to compromise organizational integrity and data confidentiality.