CVE-2026-109612 Overview
CVE-2026-109612 is a stored cross-site scripting ([CWE-79]) vulnerability in Frappe ERPNext. The flaw affects versions before 15.120.0 and 16.x releases before 16.33.0. A report view interpolates stored record names into markup without escaping them. Authenticated users with record-creation privileges can store crafted record names containing script payloads. When any other user opens the affected report, the payload executes in that user's browser session.
Critical Impact
Attackers with low-privilege authenticated access can execute arbitrary JavaScript in the sessions of administrators and other ERPNext users who view the report, enabling session hijacking, data theft, and privileged action abuse.
Affected Products
- Frappe ERPNext versions prior to 15.120.0
- Frappe ERPNext 16.x versions prior to 16.33.0
- Report view component rendering stored record names
Discovery Timeline
- 2026-10-12 - CVE-2026-109612 published to the National Vulnerability Database (NVD)
- 2026-10-12 - Last updated in NVD database
Technical Details for CVE-2026-109612
Vulnerability Analysis
The vulnerability resides in a Frappe ERPNext report view that renders stored record names directly into HTML markup. The code path interpolates user-supplied values into the DOM without applying HTML entity encoding or sanitization. Any JavaScript embedded in a record name executes when a victim loads the report. Because the payload is persisted in the database, every subsequent viewer of the report triggers execution, including administrative users.
The attack chain requires only authenticated access with permission to create records of the affected DocType. User interaction from a secondary victim viewing the report completes the exploitation.
Root Cause
The root cause is missing output encoding of user-controlled data at the template rendering boundary. Record names flow from the database into client-side markup through an unsafe interpolation path. The report view treats stored strings as trusted HTML rather than untrusted text, which violates the standard practice of context-aware escaping for all user-supplied content.
Attack Vector
An authenticated attacker creates a record with a name containing an HTML or JavaScript payload, for example a <script> tag or an event handler attribute such as onerror. The malicious record persists in the ERPNext database. When another authenticated user, including a system manager, opens the affected report, the browser parses the attacker-controlled markup and executes the embedded script in the victim's authenticated session context. The attacker can then issue API calls, exfiltrate session tokens, or pivot to additional ERPNext functionality using the victim's privileges.
See the GitHub Security Advisory GHSA-f99r-gp2w-xghj for technical details.
Detection Methods for CVE-2026-109612
Indicators of Compromise
- Record names containing HTML tags such as <script>, <img>, <svg>, or event handler attributes like onerror= and onload=
- Unexpected outbound HTTP requests originating from authenticated ERPNext browser sessions
- Creation of new administrative users or API keys shortly after a report is opened by a privileged account
- Audit log entries showing record creation by low-privilege accounts followed by sensitive actions from administrator accounts
Detection Strategies
- Query the ERPNext database for record name fields matching regular expressions that detect HTML or JavaScript syntax
- Enable Content Security Policy (CSP) reporting to capture inline script execution attempts in the ERPNext frontend
- Review web server access logs for anomalous XHR or fetch requests following report view loads
- Correlate record-create events with subsequent privileged activity to identify stored XSS exploitation chains
Monitoring Recommendations
- Monitor ERPNext audit trails for suspicious record names and unusual DocType creation patterns
- Alert on administrative API calls that originate from browser user agents immediately after a report page load
- Track session token reuse from unexpected IP addresses as an indicator of session hijacking
- Ingest ERPNext application and web logs into a centralized SIEM for correlation and historical analysis
How to Mitigate CVE-2026-109612
Immediate Actions Required
- Upgrade Frappe ERPNext to version 15.120.0 or later on the 15.x branch
- Upgrade Frappe ERPNext 16.x deployments to version 16.33.0 or later
- Audit existing records for malicious payloads in name fields and remove or sanitize any suspicious entries
- Rotate session secrets and force re-authentication for all users after patching
Patch Information
The Frappe project has released fixed versions 15.120.0 and 16.33.0 that properly escape stored record names before rendering them in the report view. Refer to the GitHub Security Advisory and the VulnCheck advisory for the full list of corrected commits and upgrade guidance.
Workarounds
- Restrict record-creation permissions on affected DocTypes to trusted users until patching completes
- Deploy a strict Content Security Policy that disallows inline scripts to limit payload execution
- Place a web application firewall in front of ERPNext with rules blocking HTML and JavaScript syntax in record name parameters
- Temporarily disable or restrict access to the vulnerable report view for non-administrative users
# Upgrade Frappe ERPNext using the bench CLI
bench switch-to-branch version-15 erpnext --upgrade
bench update --reset
bench --site all migrate
# Verify the installed ERPNext version
bench version | grep erpnext
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
