CVE-2026-109657: Frappe ERPNext Stored XSS Vulnerability

CVE-2026-109657 Overview

CVE-2026-109657 is a stored cross-site scripting (XSS) vulnerability in Frappe ERPNext versions 16.x before 16.27.0. The flaw resides in how the application renders user-supplied record names without proper HTML escaping. An authenticated user with edit rights can set a malicious record name containing JavaScript, which executes in the browser of any colleague who subsequently opens the affected page. The weakness is classified under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Attackers with edit privileges can persist arbitrary JavaScript in record names, enabling session hijacking, UI manipulation, and unauthorized actions executed under victim user context.

Affected Products

Frappe ERPNext 16.x versions prior to 16.27.0
Deployments exposing document edit rights to lower-privileged users
Multi-tenant ERPNext instances where records are shared across teams

Discovery Timeline

2026-10-12 - CVE-2026-109657 published to the National Vulnerability Database (NVD)
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-109657

Vulnerability Analysis

The vulnerability is a stored cross-site scripting flaw in the ERPNext document rendering pipeline. ERPNext uses document record names as human-readable identifiers across list views, link fields, and detail pages. When the application renders these names, it fails to apply HTML entity encoding to the output. An attacker with edit rights submits a record name containing an HTML or JavaScript payload. The payload persists in the database as part of the record metadata.

When another user navigates to any view that references the tampered record, the browser parses the injected markup as executable code. The script runs with the victim's authenticated session and ERPNext permissions. Attackers can exfiltrate session cookies, submit forms on the victim's behalf, modify financial records, or chain the flaw with privileged workflows.

For full technical details, see the GitHub Security Advisory GHSA-mvr5-2j8r-53p4 and the VulnCheck Advisory for ERPNext.

Root Cause

The root cause is missing output encoding on the record name field during server-side or client-side template rendering. ERPNext trusts the stored name attribute as safe text when it is in fact attacker-controlled input. Any template path that interpolates the record name without a safe-rendering helper introduces the injection sink.

Attack Vector

Exploitation requires network access, low privileges (an account with edit rights on the target doctype), and user interaction from a victim who opens the affected page. The attacker stores the payload once and waits for colleagues to trigger execution during normal ERP workflows.

No verified public proof-of-concept code is published for CVE-2026-109657. Refer to the vendor advisory for payload details.

Detection Methods for CVE-2026-109657

Indicators of Compromise

Record names containing HTML tags such as <script>, <img, <svg, or onerror= attributes stored in ERPNext doctype tables
Browser console errors or unexpected network callouts to attacker-controlled domains from ERPNext users
Audit log entries showing record renames to syntactically suspicious strings by non-administrative users

Detection Strategies

Query the ERPNext database for records whose name field contains angle brackets, event handler keywords, or JavaScript URI schemes
Enable and review Frappe audit trails for rename operations performed by users with edit-only permissions
Deploy a Content Security Policy (CSP) report-only header and monitor violation reports for inline script execution attempts

Monitoring Recommendations

Alert on outbound HTTP requests from authenticated ERPNext browser sessions to domains outside the organization's allowlist
Monitor web server access logs for anomalous POST or PUT requests to /api/method/frappe.client.rename_doc with unusual payload sizes
Correlate help desk tickets reporting UI anomalies or unexpected logouts with recent record modifications

How to Mitigate CVE-2026-109657

Immediate Actions Required

Upgrade all Frappe ERPNext 16.x deployments to version 16.27.0 or later without delay
Audit existing records in high-value doctypes for malicious payloads stored in the name field and sanitize or remove affected entries
Review and reduce the user population with edit rights on shared doctypes, applying least privilege
Rotate session tokens and force reauthentication for users who may have viewed tampered records

Patch Information

The maintainers addressed the vulnerability in Frappe ERPNext 16.27.0. The fix applies proper HTML escaping to record name rendering across affected views. See the GitHub Security Advisory GHSA-mvr5-2j8r-53p4 for upgrade guidance and release notes.

Workarounds

Restrict write and rename permissions on sensitive doctypes to trusted administrators until patching is complete
Deploy a strict Content Security Policy that blocks inline script execution and disallows untrusted script sources
Place a web application firewall (WAF) rule in front of ERPNext to inspect and block requests containing HTML or script syntax in record name parameters

bash

# Upgrade ERPNext via bench to the patched release
bench switch-to-branch version-16 erpnext --upgrade
bench update --patch
bench --site <your-site> migrate
bench restart