CVE-2026-109653 Details
Description
Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a stored cross-site scripting vulnerability because record fields are rendered into an HTML attribute context without escaping. A low-privilege user can store a malicious payload in a record field that executes in the browser of any privileged user who opens the affected page, enabling account takeover.
A stored cross-site scripting vulnerability has been identified in Frappe ERPNext versions prior to 15.119.0 and 16.x prior to 16.31.0. This vulnerability arises because record fields are rendered into an HTML attribute context without proper escaping. As a result, a low-privilege user can inject a malicious payload into a record field, which is then executed in the browser of any privileged user who accesses the affected page, potentially leading to account takeover.
Users are advised to upgrade to Frappe ERPNext version 15.119.0 or 16.31.0.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 12, 2026CISA-ADP
Assessed Oct 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Frappe ERPNext | < 15.119.0 (semver) < 16.31.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 13, 2026 | CVE Modified | CISA-ADP |
| Oct 12, 2026 | New CVE Received | [email protected] |