CVE-2026-48540 Details
Description
Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the lead title field. Attackers can craft a lead title containing double-brace template syntax that reaches the Vue template compiler, enabling prototype chain traversal to retrieve the Function constructor and execute attacker-supplied JavaScript in the application origin for every user who views the affected lead record.
A stored client-side template injection vulnerability has been identified in Krayin CRM versions through 2.2.6. This vulnerability allows authenticated attackers to execute arbitrary JavaScript in the browsers of other users. The issue arises from the injection of Vue.js template expressions into the lead title field, which are then processed by the Vue template compiler. Exploitation enables prototype chain traversal to access the Function constructor, allowing the execution of attacker-supplied JavaScript in the application origin for every user who views the affected lead record.
To address this vulnerability, add a 'v-pre' directive to the '<h1>' element in the leads view template. This will prevent the Vue template compiler from processing the lead title, thereby mitigating the risk of template injection and the associated cross-site scripting.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 24, 2026CISA-ADP
Assessed Sep 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/aaronamran/CVE-Disclosures/tree/main/CVE-2026/CVE-2026-48540 | CISA-ADP | ExploitTechnical Description |
| https://github.com/aaronamran/CVE-Disclosures/tree/main/CVE-2026/CVE-2026-48540 | [email protected] | ExploitTechnical Description |
| https://www.vulncheck.com/advisories/krayin-crm-stored-template-injection-xss-via-lead-title | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Krayin CRM | <= 2.2.6 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 24, 2026 | New CVE Received | [email protected] |
| Sep 24, 2026 | CVE Modified | CISA-ADP |