CVE-2026-109633: Frappe ERPNext Stored XSS Vulnerability

CVE-2026-109633 Overview

CVE-2026-109633 is a stored cross-site scripting (XSS) vulnerability in Frappe ERPNext [CWE-79]. The flaw affects versions before 15.119.1 and 16.x versions before 16.32.0. Content submitted through a public-facing booking page is stored without proper neutralization. When a privileged user later views that content in the ERPNext interface, the browser renders the attacker's payload as raw HTML. The script executes in the authenticated session, enabling account takeover.

Critical Impact
Unauthenticated attackers can submit crafted payloads through a public booking page that execute in a privileged user's browser, enabling full account takeover without any prior access.

Affected Products

Frappe ERPNext versions before 15.119.1
Frappe ERPNext 16.x versions before 16.32.0
Deployments exposing the public booking page to unauthenticated users

Discovery Timeline

2026-10-12 - CVE-2026-109633 published to the National Vulnerability Database (NVD)
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-109633

Vulnerability Analysis

The vulnerability is a stored XSS flaw in the public booking workflow of Frappe ERPNext. The booking page accepts input from unauthenticated visitors and persists it to the backend database. Server-side logic does not escape or neutralize HTML, script tags, or event handlers in the stored content. When an administrator or other privileged user opens the booking record in the ERPNext web UI, the content is injected into the DOM as raw markup. The injected JavaScript executes with the privileges of the viewing user.

Because the trigger is a routine administrative action, exploitation requires only user interaction from a legitimate operator viewing the booking. The attacker never authenticates and never interacts with the victim directly.

Root Cause

The root cause is missing output encoding on user-controlled booking data rendered in a privileged context. The application trusts input gathered from a public endpoint and stores it verbatim. Rendering routines then interpolate that content into HTML templates without applying contextual escaping, which violates the output-encoding guidance for [CWE-79].

Attack Vector

An unauthenticated attacker submits a booking request containing HTML or JavaScript payloads via the public booking page. The payload is stored in the ERPNext database. When a staff member opens the booking record, the script runs in the staff member's session. The attacker can exfiltrate session cookies, invoke privileged API endpoints, create new administrative users, or modify ERPNext records to establish persistence. Full details are available in the Frappe GitHub Security Advisory and the VulnCheck Advisory on XSS.

Detection Methods for CVE-2026-109633

Indicators of Compromise

Booking records containing <script>, <img onerror=>, <svg onload=>, or other HTML event-handler constructs in free-text fields.
Outbound requests from administrator browsers to unknown external hosts shortly after opening booking records.
Unexpected creation of new ERPNext users, API keys, or role assignments following administrator sessions.
Session cookie reuse from IP addresses that do not match the legitimate administrator's geolocation.

Detection Strategies

Review ERPNext application logs for public booking submissions containing HTML tags or JavaScript event handlers.
Deploy a web application firewall (WAF) rule that inspects booking endpoint POST bodies for script payloads.
Correlate privileged user browser activity with unexpected API calls originating from the same session.
Monitor the tabUser and role-permission tables for unauthorized additions.

Monitoring Recommendations

Enable verbose logging on the public booking endpoint and forward logs to a central SIEM for pattern analysis.
Alert on any booking record whose stored fields contain <, >, javascript:, or on*= substrings.
Track administrator session durations and privileged actions for anomalies after booking record views.

How to Mitigate CVE-2026-109633

Immediate Actions Required

Upgrade Frappe ERPNext to version 15.119.1 or 16.32.0 or later immediately.
Audit all booking records created before the patch for malicious HTML or JavaScript content.
Rotate active administrator session tokens and API keys after upgrading.
Review the ERPNext user list for unauthorized accounts or role elevations.

Patch Information

Frappe has released fixed versions 15.119.1 and 16.32.0 that neutralize HTML content submitted through the public booking page before storage and rendering. Review the Frappe GitHub Security Advisory GHSA-rv4r-c8v3-3hrc for upgrade instructions and the complete list of affected code paths.

Workarounds

Temporarily disable the public booking page if upgrading is not immediately feasible.
Restrict access to the booking endpoint by IP allowlist or authentication requirement at the reverse proxy.
Deploy a WAF rule that blocks requests containing HTML tags or script content to the booking endpoint.
Instruct administrators to avoid opening unreviewed booking records until the patch is applied.

bash

# Example nginx rule to block script payloads on the booking endpoint
location /book {
    if ($request_body ~* "(<script|onerror=|onload=|javascript:)") {
        return 403;
    }
    proxy_pass http://erpnext_backend;
}