Frappe ERPNext: Stored cross-site scripting in record fields
Summary
Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a stored cross-site scripting vulnerability in record fields, which are rendered into HTML attributes without escaping. A low-privilege user can store a malicious payload that runs in the browser of any privileged user who opens the affected page. This can lead to account takeover of the privileged user, which in ERPNext may expose finance and HR data. Exploitation requires the victim to open the affected page (user interaction).
Affected
- ERPNext versions before 15.119.0
- ERPNext 16.x versions from 16.0.0-beta.1 to before 16.31.0
Fixed in
- ERPNext 15.119.0
- ERPNext 16.31.0
Later ERPNext releases also fix further XSS issues, so the latest patch release of your branch is recommended.
Workaround
No workaround available according to the vendor. Upgrading is required.
Exploitation
- Not marked as known exploited (CISA KEV: not listed according to the sources).
- CISA SSVC: exploitation none, not automatable, partial technical impact.
- No public proof of concept found.
Our recommendation
- Check the installed ERPNext version (for example with 'bench version') and compare it with 15.119.0 and 16.31.0.
- Upgrade to the latest patch release of your branch, as later XSS fixes exist.
- Review accounts with low-privilege or portal access and remove unused ones.
- Limit internet exposure of the ERPNext desk and portals.
- Prioritise this update for instances where customer or partner users can create records.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-8pr6-r75h-h8xx github.com
- VulnCheck advisory: Frappe ERPNext before 15.119.0 Stored XSS www.vulncheck.com
- OSV: CVE-2026-109653 osv.dev
- Threatint: CVE-2026-109653 cve.threatint.com
- VulDB: CVE-2026-109653 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 10:48.
Original description (NVD)
Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a stored cross-site scripting vulnerability because record fields are rendered into an HTML attribute context without escaping. A low-privilege user can store a malicious payload in a record field that executes in the browser of any privileged user who opens the affected page, enabling account takeover.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.