CVE-2025-71432: Frappe ERPNext XSS Vulnerability

CVE-2025-71432 Overview

CVE-2025-71432 is a reflected cross-site scripting (XSS) vulnerability in Frappe ERPNext, an open-source enterprise resource planning platform. The flaw stems from missing input validation on a specific page, allowing attackers to inject arbitrary JavaScript that executes in authenticated user sessions. Remote attackers can craft malicious URLs and lure logged-in users into opening them, triggering script execution in the victim's browser context. Successful exploitation leads to account takeover, exposing confidential business data processed through ERPNext modules such as accounting, inventory, and human resources. The vulnerability affects Frappe ERPNext versions before 14.92.1 and 15.x versions before 15.83.0.

Critical Impact
Attackers can take over authenticated ERPNext accounts by tricking logged-in users into visiting a crafted URL, exposing financial, operational, and customer data.

Affected Products

Frappe ERPNext versions before 14.92.1
Frappe ERPNext 15.x versions before 15.83.0
Deployments exposing the vulnerable page to authenticated users

Discovery Timeline

2026-10-12 - CVE-2025-71432 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2025-71432

Vulnerability Analysis

The vulnerability is categorized as reflected cross-site scripting [CWE-79]. Frappe ERPNext fails to sanitize or encode user-controlled input before reflecting it into a rendered page. When a victim loads a crafted URL, the server returns the payload inside the HTML response, where the browser executes it as JavaScript within the authenticated session.

Because the payload runs in the victim's browser context, it inherits that user's cookies, CSRF tokens, and ERPNext permissions. Attackers can issue API requests on behalf of the victim, exfiltrate session identifiers, or modify records across modules the user can access. In ERPNext deployments, this includes accounting ledgers, sales orders, HR data, and administrative settings.

The attack requires user interaction, as described in the GitHub Security Advisory and VulnCheck advisory. However, delivery is trivial via phishing emails, chat messages, or compromised internal links that reference the vulnerable endpoint.

Root Cause

The root cause is missing input validation and output encoding on a specific ERPNext page. User-supplied values are placed into the response without context-aware escaping, violating the output encoding requirements for HTML, JavaScript, and attribute contexts.

Attack Vector

The attack vector is network-based and requires an authenticated victim to click a crafted URL. The attacker does not need credentials or prior access to the ERPNext instance. Once the victim loads the URL, injected JavaScript executes with the victim's session privileges, enabling account takeover.

No verified public proof-of-concept code is available. Technical details are described in the GitHub Security Advisory and the VulnCheck Advisory for Frappe ERPNext.

Detection Methods for CVE-2025-71432

Indicators of Compromise

Inbound HTTP requests to ERPNext pages containing <script>, javascript:, onerror=, or encoded variants in query strings
Unexpected outbound requests from user browsers to attacker-controlled domains following ERPNext page loads
Session or API token activity originating from unfamiliar IP addresses shortly after a user clicks an external link
New or modified ERPNext records created outside normal user workflows

Detection Strategies

Review web server and reverse proxy logs for ERPNext URLs containing script-like patterns or URL-encoded payloads such as %3Cscript%3E
Correlate authenticated session events with referrer headers pointing to external domains or email tracking links
Enable Content Security Policy (CSP) violation reporting to surface inline script execution attempts

Monitoring Recommendations

Monitor ERPNext audit logs for privilege changes, password resets, and API key creation that follow user link clicks
Alert on bulk data exports or unusual access to financial and HR modules by individual sessions
Track user-agent and geolocation anomalies on active ERPNext sessions to detect session reuse

How to Mitigate CVE-2025-71432

Immediate Actions Required

Upgrade Frappe ERPNext to version 14.92.1 or 15.83.0 or later, depending on the deployed branch
Invalidate active sessions and rotate API keys for users suspected of clicking crafted links
Communicate phishing awareness guidance to ERPNext users, emphasizing caution with external links to internal URLs

Patch Information

Frappe addressed the vulnerability in ERPNext 14.92.1 and 15.83.0. Apply the fixed versions listed in the GitHub Security Advisory. Self-hosted deployments should follow the Frappe upgrade documentation and verify module integrity after patching.

Workarounds

Restrict ERPNext access to trusted networks or VPNs until patches are applied
Deploy a web application firewall rule that blocks requests containing script tags or common XSS payloads on ERPNext endpoints
Enforce a strict Content Security Policy that disallows inline scripts and limits allowed script sources
Shorten session lifetimes and require re-authentication for sensitive operations such as role changes and payouts

bash

# Example upgrade commands for a self-hosted Frappe bench
bench update --patch
bench switch-to-branch version-15 frappe erpnext
bench get-app --branch version-15 erpnext
bench --site <your-site> migrate