Stored Cross-Site Scripting Vulnerability in Frappe ERPNext by Frappe

CVE-2026-109670

What is CVE-2026-109670?

The Frappe ERPNext software contains a stored cross-site scripting vulnerability due to insufficient escaping of record names. This security flaw allows attackers with write access to manipulate item master data, potentially injecting harmful scripts. When operators access affected pages, the malicious code can execute in their browsers, leading to unauthorized actions or data exposure. Immediate remediation and updates to versions post 15.110.0 and 16.21.0 are essential to mitigate this risk.

References