CVE-2026-109671 Overview
CVE-2026-109671 is a stored cross-site scripting (XSS) vulnerability in Frappe ERPNext affecting versions before 15.113.0 and 16.x versions before 16.24.0. The flaw resides in a profile field that is rendered into portal pages without proper output escaping. Low-privilege authenticated users can inject malicious JavaScript into the field, which then executes in the browser of any administrator who views the affected portal pages. Successful exploitation allows attackers to hijack administrator sessions and take over privileged accounts. The vulnerability is tracked under CWE-79: Improper Neutralization of Input During Web Page Generation.
Critical Impact
A low-privilege attacker can achieve full administrator account takeover by storing JavaScript that executes in an administrator's browser session.
Affected Products
- Frappe ERPNext versions prior to 15.113.0
- Frappe ERPNext 16.x versions prior to 16.24.0
- ERPNext portal pages that render the vulnerable profile field
Discovery Timeline
- 2026-10-12 - CVE-2026-109671 published to NVD
- 2026-10-15 - Last updated in NVD database
Technical Details for CVE-2026-109671
Vulnerability Analysis
The vulnerability exists in how Frappe ERPNext handles output rendering for a user-controllable profile field exposed on portal pages. The application stores user-supplied content in the database and later writes it into HTML responses without applying context-appropriate escaping. Any script tags, event handlers, or JavaScript URI payloads submitted by an authenticated low-privilege user are preserved verbatim.
When an administrator browses a portal page that displays the field, the embedded script executes in the administrator's authenticated session. The attacker gains the ability to read session cookies, invoke privileged API endpoints, modify configuration, or create backdoor administrator accounts. Because ERPNext is widely deployed as a business-critical ERP system, this exposes financial, HR, and supply chain data.
Root Cause
The root cause is a missing output encoding step in the server-side rendering pipeline for the affected profile field. Frappe's templating layer should HTML-escape untrusted content before interpolation, but the vulnerable code path emits the stored value directly into the DOM. The input validation layer does not restrict HTML or JavaScript characters at write time either, leaving no defense in depth.
Attack Vector
Exploitation requires network access to the ERPNext portal and a low-privilege authenticated account. The attacker edits their own profile field with a crafted payload containing JavaScript. The payload is persisted server-side and triggers whenever an administrator or other privileged user navigates to a page that renders the field. User interaction from the victim administrator is required to view the affected page. Full exploitation details are documented in the GitHub Security Advisory GHSA-rg9g-c26v-cw27 and the VulnCheck advisory.
Detection Methods for CVE-2026-109671
Indicators of Compromise
- Profile field values in the ERPNext database containing <script> tags, on*= event handlers, or javascript: URIs
- Unexpected outbound HTTP requests from administrator browser sessions to attacker-controlled domains
- Creation of new administrator accounts or role modifications shortly after administrator logins
- Portal page responses containing unescaped markup within profile-related DOM elements
Detection Strategies
- Query the ERPNext database directly for stored profile field values containing HTML metacharacters or JavaScript syntax
- Deploy a web application firewall rule to inspect POST requests to profile update endpoints for script payloads
- Monitor administrator session activity for anomalous API calls originating immediately after portal page views
- Review web server logs for low-privilege accounts updating profile fields with unusually long or encoded content
Monitoring Recommendations
- Log and alert on administrator-level privilege changes, role assignments, and new user creation events
- Enable Content Security Policy (CSP) reporting to capture script execution violations on portal pages
- Correlate authentication telemetry with portal page access patterns to detect session hijack indicators
How to Mitigate CVE-2026-109671
Immediate Actions Required
- Upgrade Frappe ERPNext to version 15.113.0 or later on the 15.x branch
- Upgrade Frappe ERPNext to version 16.24.0 or later on the 16.x branch
- Audit existing profile field values for stored XSS payloads and sanitize or purge malicious entries
- Rotate administrator session tokens and credentials after patching to invalidate any hijacked sessions
Patch Information
The Frappe maintainers released fixes in ERPNext 15.113.0 and 16.24.0. The patches apply proper HTML escaping when rendering the profile field on portal pages. Full remediation details are published in the GitHub Security Advisory GHSA-rg9g-c26v-cw27.
Workarounds
- Restrict portal access to trusted authenticated users until the patch is applied
- Deploy a strict Content Security Policy that disallows inline scripts on portal pages
- Use a web application firewall to block requests containing script tags or JavaScript URIs in profile update parameters
- Temporarily hide or disable the affected profile field in portal page templates
# Upgrade ERPNext using the bench CLI
bench update --reset
bench --site <site-name> migrate
# Verify installed version
bench version | grep erpnext
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
