Frappe ERPNext: Stored cross-site scripting in report view
Summary
Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a stored cross-site scripting vulnerability in a report view. The view inserts stored record names into the page without escaping them. An authenticated user who can create records can store a crafted name, which then runs script in the session of any user who later opens the report, including users with higher privileges.
Affected
- ERPNext before 15.120.0
- ERPNext 16.0.0-beta.1 up to (excluding) 16.33.0
Fixed in
- ERPNext 15.120.0
- ERPNext 16.33.0
Note: one third-party roundup lists 15.121.0 and 16.34.0 as the fix. This is unconfirmed and conflicts with the NVD, OSV and GitHub advisory data, so verify it before setting a target version.
Workaround
No workaround available according to the GitHub advisory. Upgrading is required.
- Interim measure (our analysis, not from a vendor source): restrict who can create or rename records and review recently created record names for markup or script content.
Exploitation
- No evidence of active exploitation found.
- Not listed in CISA KEV according to one aggregator; not verified directly.
- CISA SSVC: exploitation none, not automatable, technical impact total.
- No public proof of concept found.
Our recommendation
- Inventory all ERPNext instances and their versions (15.x and 16.x).
- Upgrade to at least 15.120.0 or 16.33.0 and verify the target version against the GitHub advisory.
- Review which roles can create records and check self-registration and portal access.
- Patch the whole ERPNext instance, as related ERPNext XSS and privilege issues were published in the same batch.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-f99r-gp2w-xghj github.com
- VulnCheck Advisory: Frappe ERPNext before 15.120.0 Stored XSS via Report View www.vulncheck.com
- OSV: CVE-2026-109612 osv.dev
- VulDB: vuln 417350 vuldb.com
- Strix CVE record CVE-2026-109612 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 10:50.
Original description (NVD)
Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a stored cross-site scripting vulnerability in a report view that interpolates stored record names into markup without escaping. Authenticated users able to create records can store crafted record names that execute script in the session of any user who later opens the report.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.