Stored Cross-Site Scripting Vulnerability in Frappe ERPNext

CVE-2026-109673

What is CVE-2026-109673?

Frappe ERPNext versions prior to 15.103.0 and 16.12.0 contain a vulnerability that allows attackers to implement stored cross-site scripting attacks. This occurs due to inadequate neutralization of crafted record names presented on various dashboards and portals. Authenticated users can exploit this flaw to execute malicious scripts within the browsers of other users, particularly affecting those with elevated privileges. This can lead to unauthorized data access, modification, and theft of sensitive tokens.

References