CVE-2026-109673

high

Description

Frappe ERPNext before 15.103.0 and 16.x before 16.12.0 contains a stored cross-site scripting vulnerability because the names of certain records are not properly neutralized when rendered on some dashboards, tools, and portals. Authenticated attackers can craft malicious record names that execute scripts in other users' browsers, enabling data access, modification, and token theft, especially against privileged users.

References

https://www.vulncheck.com/advisories/frappe-erpnext-before-16.12.0-stored-xss-via-crafted-record-names

https://github.com/frappe/erpnext/security/advisories/GHSA-r99h-h44m-89m2

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-98064

Details

Source: Mitre, NVD

Published: 2026-10-12

Updated: 2026-10-13

Risk Information

CVSS v2

Base Score: 8.5

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:N

Severity: High

CVSS v3

Base Score: 7.3

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Severity: High

CVSS v4

Base Score: 8.5

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Severity: High

EPSS

EPSS: 0.00211