CVE-2026-109657: Frappe ERPNext 16.x before 16.27.0 Stored XSS via Unescaped Record Name

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-12 · updated 2026-10-14
Weakness: CWE-79

Description

Frappe ERPNext 16.x before 16.27.0 contains a stored cross-site scripting vulnerability that allows users with edit rights to inject script through a record name rendered without escaping. Attackers can set a malicious record name so the script runs in the browser of any colleague who opens the page.

Affected products

frappe erpnext: from 16.0.0-beta.1 before 16.27.0 — fixed in 16.27.0

How to fix

Upgrade to a fixed version: frappe erpnext 16.27.0. Check the vendor advisory for mitigations.

References

https://github.com/frappe/erpnext/security/advisories/GHSA-mvr5-2j8r-53p4
https://www.vulncheck.com/advisories/frappe-erpnext-16-x-before-16.27.0-stored-xss-via-unescaped-record-name

Get alerted when CVE-2026-109657 or the next vulnerability affects your stack