CVE-2026-109673 in ERPNext
Summary
by MITRE • 10/13/2026
Frappe ERPNext before 15.103.0 and 16.x before 16.12.0 contains a stored cross-site scripting vulnerability because the names of certain records are not properly neutralized when rendered on some dashboards, tools, and portals. Authenticated attackers can craft malicious record names that execute scripts in other users' browsers, enabling data access, modification, and token theft, especially against privileged users.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/13/2026
The vulnerability identified in Frappe ERPNext versions prior to 15.103.0 and 16.x prior to 16.12.0 represents a significant security flaw classified as a stored cross-site scripting (XSS) issue. This type of vulnerability arises when an application stores untrusted data, such as user input or record names, in a database without adequately sanitizing it before rendering that data back to users on subsequent requests. In the specific context of ERPNext, this failure occurs within certain dashboards, tools, and portals where the system displays information about various records. The core technical flaw lies in the improper neutralization of special characters or script tags embedded within record names. When these maliciously crafted strings are retrieved from storage and rendered into HTML content without proper encoding or escaping, they execute as active scripts within the context of the victim's browser session rather than being treated as inert text data.
From an operational perspective, this vulnerability allows authenticated attackers to inject persistent malicious payloads directly into the application’s database through legitimate record creation or modification actions. Because the payload is stored server-side and served dynamically to other users upon their next visit to the affected dashboard or portal, it does not require complex social engineering tactics like phishing links for each victim; instead, any user with access rights who views the compromised page will trigger the execution of the attacker's script. This persistence distinguishes stored XSS from reflected variants, making it particularly dangerous in enterprise environments where multiple users frequently interact with shared data sets and dashboards. The attack vector is effectively closed-loop within the application’s normal workflow, as attackers simply need to create or edit a record containing malicious JavaScript code, which then propagates automatically to all viewers of that specific view.
The impact of this vulnerability extends beyond mere script execution, encompassing severe risks related to data integrity and confidentiality. Attackers can leverage the executed scripts to perform actions on behalf of victims due to the browser's same-origin policy, effectively hijacking active sessions. This capability enables unauthorized access to sensitive business data, modification or deletion of critical records, and theft of authentication tokens such as session cookies or CSRF tokens. The risk is amplified significantly when privileged users view these compromised views, as successful exploitation against an administrator could lead to full system compromise. By stealing session identifiers, attackers can maintain persistent access even after the original victim logs out, facilitating long-term unauthorized control over the ERPNext instance and potentially leading to broader organizational data breaches or operational disruption.
To mitigate this vulnerability, organizations must prioritize immediate patching by upgrading Frappe ERPNext to version 15.103.0 or later for the v15 branch, or version 16.12.0 or later for the v16 branch. These updates contain the necessary code changes to properly sanitize and encode record names before rendering them in HTML contexts, thereby neutralizing any embedded script tags. In addition to applying vendor patches, administrators should implement strict input validation policies that reject suspicious characters at the point of entry where feasible, although server-side output encoding remains the primary defense against stored XSS. Security teams should also review access controls for dashboards and portals displaying user-generated content, ensuring that only necessary personnel have visibility into areas prone to such manipulation. Regular security audits focusing on data handling practices within web applications are essential to detect similar sanitization failures across other modules of the ERP system.
This vulnerability aligns with Common Weakness Enumeration identifier CWE-79, which covers Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. It also maps to MITRE ATT&CK technique T1059, specifically sub-technique 007 for JavaScript execution, and potentially T1213 for Data from Information Repositories if the attacker uses stored data to facilitate further attacks. Understanding these mappings helps in categorizing the risk within broader threat intelligence frameworks and ensures that remediation efforts address both the immediate technical flaw and the underlying process failures in input handling and output encoding standards.