CVE-2026-48541 Details
Description
Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the person name field. Attackers can craft a person name containing double-brace template syntax that reaches the Vue template compiler, enabling prototype chain traversal to retrieve the Function constructor and execute attacker-supplied JavaScript in the application origin for every user who views the affected person record.
A stored client-side template injection vulnerability has been identified in Krayin CRM versions 0 through 2.2.6. This vulnerability allows authenticated attackers to execute arbitrary JavaScript in the browsers of other users. The issue arises from the injection of Vue.js template expressions into the person name field, which are then processed by the Vue template compiler. Exploitation enables prototype chain traversal to access the Function constructor, allowing the execution of attacker-supplied JavaScript in the application origin for every user who views the affected person record.
To address this vulnerability, add a 'v-pre' directive to the '<h3>' element that displays the person's name in the view template. This will prevent the Vue.js template compiler from processing the injected expressions.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/aaronamran/CVE-Disclosures/tree/main/CVE-2026/CVE-2026-48541 | [email protected] | ExploitTechnical Description |
| https://www.vulncheck.com/advisories/krayin-crm-stored-template-injection-xss-via-contact-name-field | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Krayin CRM | <= 2.2.6 (semver) |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 24, 2026 | New CVE Received | [email protected] |