CVE-2026-109673 Overview
CVE-2026-109673 is a stored cross-site scripting (XSS) vulnerability in Frappe ERPNext [CWE-79]. The flaw affects ERPNext versions before 15.103.0 and 16.x versions before 16.12.0. The vulnerability stems from improper neutralization of record names when they are rendered on certain dashboards, tools, and portals. Authenticated attackers can craft malicious record names containing script payloads. When privileged users view the affected interfaces, the scripts execute in their browser session. This enables data access, data modification, and session or API token theft against higher-privileged accounts.
Critical Impact
Authenticated attackers can execute arbitrary JavaScript in administrator browsers, leading to account takeover and theft of sensitive ERP data.
Affected Products
- Frappe ERPNext versions prior to 15.103.0
- Frappe ERPNext 16.x versions prior to 16.12.0
- Dashboards, tools, and portals that render record names
Discovery Timeline
- 2026-10-12 - CVE-2026-109673 published to NVD
- 2026-10-13 - Last updated in NVD database
Technical Details for CVE-2026-109673
Vulnerability Analysis
ERPNext stores record names supplied by authenticated users across many document types. The application renders these names in multiple presentation contexts, including dashboard widgets, administrative tools, and customer-facing portals. The affected render paths do not apply HTML encoding or sanitization to the stored values.
An attacker with permission to create or rename records can embed JavaScript inside a record name. When another user loads a view that renders the name without escaping, the payload executes in that user's authenticated session. Impact scales with the privilege of the victim account, since administrators regularly access the dashboards and tools where injected payloads trigger.
Root Cause
The root cause is missing output encoding on record name fields across several rendering paths. The affected templates and client-side components concatenate record names directly into the DOM instead of binding them as text content or applying HTML entity encoding. This is a classic stored XSS pattern [CWE-79], where trusted-looking metadata becomes an injection sink.
Attack Vector
Exploitation requires an authenticated account with the ability to create or modify records whose names are later rendered on an affected dashboard, tool, or portal. The attacker injects a payload such as an inline event handler or script tag into the name field. When a victim with higher privileges opens the view, the browser parses and executes the payload. Captured session cookies, CSRF tokens, or API keys can then be exfiltrated to attacker-controlled infrastructure. User interaction is required because the victim must load the affected interface.
See the GitHub Security Advisory GHSA-r99h-h44m-89m2 and the VulnCheck Advisory on XSS for additional technical context.
Detection Methods for CVE-2026-109673
Indicators of Compromise
- Record names containing HTML tags, <script> fragments, javascript: URIs, or inline event handlers such as onerror= or onload=.
- Outbound HTTP requests from browser sessions to unexpected domains shortly after an administrator opens an ERPNext dashboard.
- Unexplained creation of API keys, password resets, or new privileged users following access to affected tools or portals.
Detection Strategies
- Query the ERPNext database for name or title fields containing angle brackets, backticks, or script-related keywords.
- Review web server and reverse proxy logs for POST requests that create or rename records with suspicious payloads in body parameters.
- Correlate privileged user sessions with anomalous outbound requests to identify payload callbacks or token exfiltration.
Monitoring Recommendations
- Enable browser Content Security Policy (CSP) violation reporting to surface attempted script execution on ERPNext pages.
- Monitor Frappe audit logs for mass renaming activity, especially from newly provisioned or low-privilege accounts.
- Alert on authentication events or administrative actions originating from unusual IPs immediately after dashboard access.
How to Mitigate CVE-2026-109673
Immediate Actions Required
- Upgrade Frappe ERPNext to version 15.103.0, 16.12.0, or later as soon as possible.
- Audit existing record names across all doctypes for HTML or JavaScript content and sanitize or delete malicious entries.
- Rotate API keys, session secrets, and privileged user credentials if exploitation is suspected.
Patch Information
Frappe has released fixed versions 15.103.0 for the 15.x branch and 16.12.0 for the 16.x branch. Both releases apply proper output encoding to record name rendering across the affected dashboards, tools, and portals. Refer to the GitHub Security Advisory GHSA-r99h-h44m-89m2 for upgrade guidance.
Workarounds
- Restrict record creation and renaming permissions to trusted users until the patch is applied.
- Deploy a strict Content Security Policy that disallows inline scripts on ERPNext origins to blunt payload execution.
- Place a web application firewall rule in front of ERPNext to block requests whose record name parameters contain HTML or script tokens.
# Example upgrade commands for a Frappe bench deployment
bench update --reset
bench switch-to-branch version-15 erpnext frappe --upgrade
bench --site all migrate
# Verify installed version meets the fixed release
bench version | grep erpnext
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
