Frappe ERPNext: Stored cross-site scripting via crafted record names
Summary
Frappe ERPNext before 15.103.0 and 16.x before 16.12.0 contains a stored cross-site scripting (XSS) vulnerability (CVE-2026-109673). Record names are not properly neutralized when shown on some dashboards, tools and portals. An authenticated attacker who creates a crafted record name can run scripts in other users' browsers, which may allow data access, data modification and token theft, especially against privileged users.
Affected
- ERPNext versions 0 to before 15.103.0
- ERPNext 16.0.0-beta.1 to before 16.12.0
Fixed in
- 15.103.0 (15.x branch)
- 16.12.0 (16.x branch)
- Later patched releases of your branch are recommended, as newer advisories fix other flaws.
Workaround
- No workaround available according to the vendor advisory; upgrading is required.
- Interim measures (not from the vendor): limit who can create or rename records and review recently created records with unusual names.
Exploitation
- CISA SSVC: exploitation none, not automatable, partial technical impact.
- No evidence of exploitation in the wild found; not listed in CISA KEV.
- No public proof of concept specific to this CVE found.
Our recommendation
- Identify all ERPNext installations and their versions.
- Upgrade to 15.103.0 or 16.12.0, or to the latest patched release of your branch.
- Note that related record-name XSS issues have separate fixes (for example 15.112.0 / 16.23.0 and 15.120.0 / 16.33.0), so treat them as one upgrade task.
- Until patched, restrict record creation and dashboard/portal access for privileged users and monitor for unusual record names.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-r99h-h44m-89m2 github.com
- VulnCheck Advisory: Frappe ERPNext Stored XSS via Crafted Record Names www.vulncheck.com
- OSV: CVE-2026-109673 osv.dev
- Vulners PT-2026-111023 (related ERPNext record-name XSS) vulners.com
- Vulners PT-2026-111028 (related ERPNext record-name XSS) vulners.com
- GitHub Security Advisory GHSA-x635-wr4c-7345 (later ERPNext fix) github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 10:47.
Original description (NVD)
Frappe ERPNext before 15.103.0 and 16.x before 16.12.0 contains a stored cross-site scripting vulnerability because the names of certain records are not properly neutralized when rendered on some dashboards, tools, and portals. Authenticated attackers can craft malicious record names that execute scripts in other users' browsers, enabling data access, modification, and token theft, especially against privileged users.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.