[ CVE-2026-109653 · Published 12 Oct 2026 ]
Vulnerability in frappe erpnext
CVSS 7.3
EPSS <1%No fix listed yet
[ Description ]Official description
Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a stored cross-site scripting vulnerability because record fields are rendered into an HTML attribute context without escaping. A low-privilege user can store a malicious payload in a record field that executes in the browser of any privileged user who opens the affected page, enabling account takeover.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.