CVE-2026-109662 Overview
CVE-2026-109662 is a stored cross-site scripting (XSS) vulnerability [CWE-79] in Frappe ERPNext. The flaw affects versions before 15.112.0 and 16.x versions before 16.23.0. A public portal form accepts unauthenticated submissions and stores content that is later rendered with insufficient output neutralisation. Unauthenticated attackers can submit crafted markup that executes in the browser sessions of staff users who review the stored record. The vulnerability enables attackers to run arbitrary JavaScript in the context of authenticated reviewers without any prior access to the application.
Critical Impact
Unauthenticated attackers can inject persistent JavaScript into ERPNext records, executing in staff browser sessions and compromising confidentiality and integrity of reviewed data.
Affected Products
- Frappe ERPNext versions before 15.112.0
- Frappe ERPNext 16.x versions before 16.23.0
- Deployments exposing public portal forms to unauthenticated submission
Discovery Timeline
- 2026-10-12 - CVE-2026-109662 published to NVD
- 2026-10-14 - Last updated in NVD database
Technical Details for CVE-2026-109662
Vulnerability Analysis
The vulnerability resides in a public-facing portal form in Frappe ERPNext. The form accepts submissions from unauthenticated users and persists the supplied content to the application database. When staff members later open the stored record in the ERPNext interface, the rendering layer fails to neutralise HTML and script content embedded in the submission. Any JavaScript injected by the attacker executes within the authenticated staff session.
Stored XSS in a back-office review workflow carries meaningful risk because reviewers typically operate with elevated permissions. An attacker can harvest session tokens, pivot into administrative actions, or exfiltrate business data visible to the reviewer. Because the injection vector is unauthenticated, attackers can target any ERPNext instance that exposes the vulnerable portal form.
Root Cause
The root cause is insufficient output encoding when rendering user-supplied content from the public portal form. The application stores raw input and later emits it into an HTML context without contextual escaping, satisfying the preconditions for stored XSS classified under [CWE-79].
Attack Vector
The attack vector is network-based and requires no authentication. An attacker submits a crafted payload containing HTML or JavaScript through the vulnerable portal form. The payload is stored server-side and executes when a staff user navigates to the record in the ERPNext administrative interface. Exploitation requires user interaction from the reviewer, who must open the attacker-controlled record.
See the GitHub Security Advisory GHSA-4rfh-2hfg-9m7w and the VulnCheck Advisory on Stored XSS for additional technical context.
Detection Methods for CVE-2026-109662
Indicators of Compromise
- Portal form submissions containing HTML tags such as <script>, <img onerror=>, <svg onload=>, or encoded JavaScript URIs.
- Outbound HTTP requests from staff browsers to unexpected external domains shortly after reviewing portal-submitted records.
- Unexpected session cookie access patterns or API calls originating from reviewer accounts without corresponding user actions.
Detection Strategies
- Inspect ERPNext database tables that back public portal forms for stored values containing script tags or event handler attributes.
- Deploy a web application firewall rule to flag submissions to portal form endpoints that include HTML control characters or script syntax.
- Correlate reviewer account activity against access logs to identify anomalous requests triggered by rendered content.
Monitoring Recommendations
- Enable Content Security Policy (CSP) violation reporting on ERPNext frontends to surface inline script execution attempts.
- Monitor Frappe application logs for unauthenticated POST requests to portal form endpoints originating from unusual source IPs.
- Track staff session activity for signs of hijacking, such as concurrent sessions, geolocation anomalies, or unexpected privilege use.
How to Mitigate CVE-2026-109662
Immediate Actions Required
- Upgrade Frappe ERPNext to version 15.112.0 or later on the 15.x branch.
- Upgrade Frappe ERPNext to version 16.23.0 or later on the 16.x branch.
- Audit existing public portal form submissions for stored payloads containing HTML or script content and sanitise affected records.
- Rotate session tokens and credentials for staff accounts that reviewed records during the exposure window.
Patch Information
Frappe has addressed CVE-2026-109662 in ERPNext 15.112.0 and 16.23.0. The fix enforces proper output neutralisation when rendering content submitted through the affected portal form. Review the GitHub Security Advisory GHSA-4rfh-2hfg-9m7w for release details and upgrade guidance.
Workarounds
- Restrict access to the vulnerable public portal form by placing it behind authentication or an IP allowlist until patching is complete.
- Deploy a web application firewall rule that strips or rejects HTML tags and script content in submissions to portal form endpoints.
- Instruct staff reviewers to avoid opening portal submissions in production browsers and use an isolated review environment pending the upgrade.
# Configuration example
bench update --patch
bench --site <site-name> migrate
bench --site <site-name> set-config developer_mode 0
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
