What’s Vulnerable › Vulnerabilities

CVE-2026-109604: ERPNext before 15.112.0 Stored XSS via Tool View Record Names

• Severity: high (CVSS 7.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-12 · updated 2026-10-18
• Weakness: CWE-79

Description

Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a stored cross-site scripting vulnerability because a tool view interpolates stored record names into markup without escaping. An authenticated user able to create such records can give them malicious names, executing script in the session of any user who later opens that tool.

Affected products

• frappe erpnext: before 15.112.0; from 16.0.0-beta.1 before 16.23.0 — fixed in 15.112.0, 16.23.0

How to fix

Upgrade to a fixed version: frappe erpnext 15.112.0, 16.23.0. Check the vendor advisory for mitigations.

References

• https://github.com/frappe/erpnext/security/advisories/GHSA-734c-hv9r-mg2c
• https://www.vulncheck.com/advisories/erpnext-before-15.112.0-stored-xss-via-tool-view-record-names

Get alerted when CVE-2026-109604 or the next vulnerability affects your stack