Frappe ERPNext: Stored cross-site scripting via tool view record names
Summary
ERPNext before 15.112.0 and 16.x before 16.23.0 contains a stored cross-site scripting (XSS) flaw in a tool view that renders stored record names without escaping. An authenticated user who can create records can give them a malicious name, so script runs in the session of any user who later opens that tool. The attack requires a victim to open the affected tool view, and the flaw is not directly reachable from the internet.
Affected
- ERPNext versions before 15.112.0
- ERPNext 16.x from 16.0.0-beta.1 before 16.23.0
Fixed in
- ERPNext 15.112.0
- ERPNext 16.23.0
Workaround
- No vendor workaround documented. Upgrading is the documented remedy.
- Interim measure: limit who can create or rename records and review existing record names for HTML or script content.
Exploitation
- No public exploit known according to VulDB.
- CISA SSVC: exploitation none, automatable no.
- No evidence of in-the-wild exploitation or CISA KEV listing found.
Our recommendation
- Confirm installed ERPNext versions on the 15.x and 16.x lines.
- Upgrade to 15.112.0 or 16.23.0 or later.
- Check whether related flaws CVE-2026-109612 (report view, fixed in 15.120.0 and 16.33.0) and CVE-2026-109662 (unauthenticated portal form XSS) require a newer release.
- Limit record creation and renaming to trusted users until patched.
- Review the GitHub advisory for any updates.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-734c-hv9r-mg2c github.com
- VulnCheck advisory: ERPNext stored XSS via tool view record names www.vulncheck.com
- OSV entry CVE-2026-109604 osv.dev
- VulDB entry 417351 vuldb.com
- Strix CVE-2026-109604 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 10:51.
Original description (NVD)
Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a stored cross-site scripting vulnerability because a tool view interpolates stored record names into markup without escaping. An authenticated user able to create such records can give them malicious names, executing script in the session of any user who later opens that tool.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.