CVE-2026-109657

5.4Medium

Published 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

5.4Medium

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: Required
Impact: Limited impact
Weakness: CWE-79

Impact

Authenticated users with edit permissions can execute arbitrary JavaScript in the browsers of colleagues who view the affected page. This requires network access to the ERPNext instance and an account with edit rights to set a malicious record name.

Root cause

The application fails to sanitize and escape record names before rendering them in the web interface.

Affected systems

Frappe ERPNext 16.x before 16.27.0

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Fix & remediation

Upgrade Frappe ERPNext to version 16.27.0 or later. If patching immediately is not possible, restrict edit permissions on records to trusted personnel until the update is applied.

shell

$ bench update --apps erpnext

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Frappe ERPNext 16.x before 16.27.0 contains a stored cross-site scripting vulnerability that allows users with edit rights to inject script through a record name rendered without escaping. Attackers can set a malicious record name so the script runs in the browser of any colleague who opens the page.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-109657