CVE-2026-109673

CVSS 8.5 (high) · published 2026-10-12

Frappe ERPNext before 15.103.0 and 16.x before 16.12.0 contains a stored cross-site scripting vulnerability because the names of certain records are not properly neutralized when rendered on some dashboards, tools, and portals. Authenticated attackers can craft malicious record names that execute scripts in other users' browsers, enabling data access, modification, and token theft, especially against privileged users.

Weakness: CWE-79

Source: NVD CVE-2026-109673

References

• https://github.com/frappe/erpnext/security/advisories/GHSA-r99h-h44m-89m2
• https://www.vulncheck.com/advisories/frappe-erpnext-before-16.12.0-stored-xss-via-crafted-record-names

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.