CVE-2026-109653 Overview
CVE-2026-109653 is a stored cross-site scripting (XSS) vulnerability in Frappe ERPNext [CWE-79]. Affected versions include ERPNext before 15.119.0 and the 16.x branch before 16.31.0. The flaw exists because record fields are rendered into an HTML attribute context without proper escaping. A low-privilege user can inject a malicious payload into a record field. When a privileged user later opens the affected page, the payload executes in their browser session. Successful exploitation enables account takeover of administrative users.
Critical Impact
A low-privilege attacker can store JavaScript in ERPNext record fields that executes in a privileged user's browser, leading to session hijacking and full account takeover.
Affected Products
- Frappe ERPNext versions prior to 15.119.0
- Frappe ERPNext 16.x versions prior to 16.31.0
- Deployments exposing record creation to low-privilege users
Discovery Timeline
- 2026-10-12 - CVE-2026-109653 published to NVD
- 2026-10-13 - Last updated in NVD database
Technical Details for CVE-2026-109653
Vulnerability Analysis
The vulnerability resides in ERPNext's rendering of user-controlled record field values into HTML attribute contexts. When the application constructs page markup, it embeds field data directly inside attribute delimiters without applying attribute-context escaping. An attacker with permission to create or edit records can submit a payload that breaks out of the attribute and introduces executable JavaScript.
The payload persists in the ERPNext database. Each time a privileged user navigates to a page that renders the tainted field, the browser parses the injected markup and executes the attacker's script in the victim's authenticated session. This includes session cookies, CSRF tokens, and any API capabilities tied to the victim's role.
Root Cause
The root cause is improper neutralization of input during web page generation [CWE-79], specifically in an HTML attribute context. Attribute-context output requires encoding of characters such as ", ', <, >, and backtick, along with safe quoting of attribute values. ERPNext's affected templates omitted this encoding step for several record fields.
Attack Vector
Exploitation requires network access to the ERPNext web interface and low-privilege authenticated access. The attacker stores a crafted payload in a vulnerable record field. Delivery to the victim occurs when a privileged user, such as an administrator or finance approver, opens the record or a list view that renders the field. The user interaction requirement is satisfied by routine business workflows, which makes targeted social engineering unnecessary.
The vulnerability is described in prose in the GitHub Security Advisory GHSA-8pr6-r75h-h8xx and the VulnCheck Advisory for Frappe ERPNext. No verified proof-of-concept code is publicly available at the time of writing.
Detection Methods for CVE-2026-109653
Indicators of Compromise
- Record fields containing HTML attribute-breaking characters such as ", onerror=, onclick=, or <script> fragments.
- Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after opening ERPNext records.
- New administrator or system manager accounts created without an approved change ticket.
- Session or API token reuse from geographically or network-distinct sources.
Detection Strategies
- Query the ERPNext database for stored field values matching HTML event-handler patterns (for example on[a-z]+\s*=) or javascript: URIs.
- Inspect web server access logs for POST requests to record endpoints submitted by low-privilege roles followed by GETs from privileged users.
- Review browser Content Security Policy (CSP) violation reports if CSP is enabled on the ERPNext deployment.
Monitoring Recommendations
- Enable audit logging on record create and update events and alert on payloads containing script-related tokens.
- Monitor administrator session activity for anomalous API calls, bulk exports, or user role modifications.
- Correlate authentication events with unusual client fingerprints to identify stolen session reuse.
How to Mitigate CVE-2026-109653
Immediate Actions Required
- Upgrade ERPNext to version 15.119.0 or later on the 15.x branch.
- Upgrade ERPNext to version 16.31.0 or later on the 16.x branch.
- Audit existing records for stored payloads and sanitize or remove any field values containing executable HTML.
- Rotate credentials and session tokens for privileged users who accessed potentially tainted records before patching.
Patch Information
Frappe published fixes in ERPNext 15.119.0 and 16.31.0. Deployment details and affected version ranges are documented in the GitHub Security Advisory GHSA-8pr6-r75h-h8xx. Operators running self-hosted ERPNext should pull the fixed release and redeploy. Frappe Cloud customers should confirm their site version against the fixed release list.
Workarounds
- Restrict record creation and edit permissions for untrusted or low-privilege roles until patching is complete.
- Deploy a strict Content Security Policy that disallows inline scripts and event handlers to reduce exploitability.
- Place ERPNext behind a web application firewall with rules that block attribute-breaking payloads in record submissions.
# Upgrade ERPNext using the bench CLI
bench update --reset
bench --site <site-name> migrate
bench version | grep erpnext
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
