CVE-2026-48543 Details
Description
Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the web form description field. Attackers can craft a web form description containing double-brace template syntax that reaches the Vue template compiler, enabling prototype chain traversal to retrieve the Function constructor and execute attacker-supplied JavaScript in the application origin for every user who views the affected web form.
A stored client-side template injection vulnerability has been identified in Krayin CRM versions 0 through 2.2.6. This vulnerability allows authenticated attackers to execute arbitrary JavaScript in the browsers of other users. By injecting Vue.js template expressions into the web form description field, attackers can craft a payload that is processed by the Vue template compiler. This exploitation enables prototype chain traversal to access the Function constructor, allowing the execution of attacker-supplied JavaScript in the application origin for every user who views the affected web form.
To address this vulnerability, add a 'v-pre' directive to the 'h3' element that displays the person's name in the Blade template file responsible for rendering the contact details.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 24, 2026CISA-ADP
Assessed Sep 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/aaronamran/CVE-Disclosures/tree/main/CVE-2026/CVE-2026-48541 | CISA-ADP | ExploitTechnical Description |
| https://github.com/aaronamran/CVE-Disclosures/tree/main/CVE-2026/CVE-2026-48541 | [email protected] | ExploitTechnical Description |
| https://www.vulncheck.com/advisories/krayin-crm-stored-template-injection-xss-via-web-form-description | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Krayin CRM | <= 2.2.6 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 25, 2026 | CVE Modified | CISA-ADP |
| Sep 24, 2026 | New CVE Received | [email protected] |