CSP Nonce Injection in EspoCRM Affects User Session Security
CVE-2026-53575

2.7LOW

Key Information:

Vendor

Espocrm

Status
Espocrm
Vendor
CVE Published:
15 October 2026

What is CVE-2026-53575?

EspoCRM is an open-source customer relationship management solution that contains a vulnerability allowing authenticated administrators to inject crafted content into the applicationName setting via CSP nonce injection. This vulnerability occurs before version 9.3.9, where a persistent injection is embedded within the main application page without appropriate escaping. As a result, attacker-controlled JavaScript can execute in user sessions, potentially leaking sensitive page data, including any unsaved user inputs. EspoCRM has addressed this issue in version 9.3.9, and users are encouraged to update to ensure their systems are secure.

Affected Version(s)

espocrm < 9.3.9

References

https://github.com/espocrm/espocrm/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/espocrm/espocrm/commit/ce73338ea7b4639...
x_refsource_MISC
https://github.com/espocrm/espocrm/releases/tag/9.3.9
x_refsource_MISC

CVSS V3.1

Score:
2.7
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.