CVE-2026-109657 in ERPNext
Summary
by MITRE • 10/13/2026
Frappe ERPNext 16.x before 16.27.0 contains a stored cross-site scripting vulnerability that allows users with edit rights to inject script through a record name rendered without escaping. Attackers can set a malicious record name so the script runs in the browser of any colleague who opens the page.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/13/2026
The identified security flaw resides within Frappe ERPNext versions prior to 16.27.0 and is classified as a stored cross-site scripting vulnerability, commonly referred to by its CWE identifier CWE-79. This specific type of injection attack occurs because the application fails to properly sanitize user-supplied input before including it in web pages that are subsequently served to other users. In this particular instance, the point of failure is the rendering of record names within the ERPNext interface. When a user with edit privileges creates or modifies a record, they have the ability to define its name field. The application processes this input and stores it directly into the database without applying adequate encoding or escaping mechanisms for HTML contexts. Consequently, when another authorized user accesses the page displaying this record, their browser interprets the stored malicious script as executable code rather than static text data.
The operational impact of this vulnerability is significant due to its persistent nature and broad potential reach within an organization using ERPNext. Unlike reflected XSS attacks that require tricking a user into clicking a specially crafted link, stored XSS persists on the server side, meaning every subsequent visitor to the affected page becomes a potential victim without any additional effort from the attacker. An adversary who has obtained edit rights can embed JavaScript payloads in record names designed to steal session cookies, capture keystrokes, or perform actions on behalf of the unsuspecting user. This effectively allows for account takeover scenarios where the attacker gains full control over the compromised user's identity within the ERP system. Furthermore, because ERPNext often handles sensitive business data including financial records and customer information, successful exploitation could lead to severe confidentiality breaches and integrity violations across critical enterprise operations.
From a threat intelligence perspective, this vulnerability aligns with MITRE ATT&CK technique T1059.007 which covers JavaScript execution within web browsers as part of the Execution tactic. The attack vector leverages social engineering principles indirectly by relying on trusted colleagues to view the compromised page, thereby bypassing perimeter defenses that might otherwise block external malicious links. The persistence mechanism ensures long-term access and continuous risk exposure until the underlying code defect is addressed or the malicious records are manually purged from the database. This makes remediation more complex than simple input validation fixes since historical data may already contain embedded payloads requiring cleanup procedures alongside software updates.
To mitigate this vulnerability, organizations must immediately upgrade to Frappe ERPNext version 16.27.0 or later where the rendering logic has been corrected to properly escape special characters in record names before they are inserted into HTML output streams. Implementing a Content Security Policy header can provide an additional layer of defense by restricting the sources from which scripts can be loaded and executed, thereby neutralizing many inline script injection attempts even if other vulnerabilities exist. Additionally, enforcing strict input validation rules on all user-facing fields that render to HTML contexts is essential for preventing similar issues across different modules within the application. Regular security audits focusing on output encoding practices should become a standard part of the development lifecycle to ensure that future updates do not reintroduce these critical flaws into enterprise environments relying on ERPNext for mission-critical processes.