CVE-2026-48540: Krayin CRM Stored XSS Vulnerability

CVE-2026-48540 Overview

CVE-2026-48540 is a stored client-side template injection vulnerability in Krayin CRM through version 2.2.6. Authenticated attackers can inject Vue.js template expressions into the lead title field. The injected expressions reach the Vue template compiler and execute arbitrary JavaScript in the browsers of other users who view the affected lead record. The flaw is tracked under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact

Any authenticated Krayin CRM user can plant persistent JavaScript payloads that execute in the application origin for every subsequent viewer of the lead, enabling session theft, forced actions, and lateral compromise within the CRM.

Affected Products

• Krayin CRM versions up to and including 2.2.6
• Deployments using the Vue.js client-side template rendering in lead views
• Self-hosted and container-based Krayin CRM installations

Discovery Timeline

• 2026-09-24 - CVE-2026-48540 published to the National Vulnerability Database
• 2026-09-24 - Last updated in the NVD database

Technical Details for CVE-2026-48540

Vulnerability Analysis

Krayin CRM renders the lead title field through the Vue.js template compiler on the client side. The application fails to strip or neutralize Vue template delimiters before passing the stored value into the compile stage. An authenticated user with permission to create or edit a lead can submit a title containing double-brace syntax such as {{ expression }}. When another user loads the lead listing or detail view, the browser compiles the attacker-controlled expression as a Vue template.

Because the Vue template context exposes object prototypes, the expression can traverse the prototype chain to reach the Function constructor. The attacker then returns a function body that runs arbitrary JavaScript inside the application origin. The payload executes with the viewing user's session cookies and CRM privileges. See the VulnCheck advisory and the public disclosure repository for technical specifics.

Root Cause

The root cause is unsanitized interpolation of user-controlled strings into a client-side template engine. Vue treats {{ ... }} sequences as live expressions rather than literal text. Krayin stores and re-renders the lead title without encoding or escaping these delimiters, so stored input becomes executable template syntax at render time.

Attack Vector

The attack requires low-privileged authenticated access to create or modify a lead. The attacker places a crafted template expression in the lead title and waits for other users to view the record. User interaction is required for payload execution, since a victim must open the affected lead view. Impact extends beyond the attacker's own session, giving the issue stored cross-site scripting characteristics across the CRM user base.

No verified proof-of-concept code is published with this advisory. Refer to the GitHub disclosure repository for reproduction details.

Detection Methods for CVE-2026-48540

Indicators of Compromise

• Lead title values containing Vue template delimiters such as {{, }}, v-bind, v-on, or references to constructor, Function, or __proto__.
• Unexpected outbound HTTP requests from browser sessions immediately after viewing specific lead records.
• Lead records authored or last modified by low-privileged accounts that contain non-human-readable title strings.

Detection Strategies

• Query the Krayin database for leads whose title column matches regular expressions targeting template syntax or prototype traversal patterns.
• Enable Content Security Policy (CSP) reporting and alert on script-src violations originating from CRM pages that render lead data.
• Review web server access logs for POST and PUT requests to lead creation and update endpoints with payload bodies containing double-brace sequences.

Monitoring Recommendations

• Monitor browser-side error telemetry for Vue compiler warnings referencing unexpected expressions in production builds.
• Track CRM audit logs for lead create and update events from accounts that normally do not perform data-entry actions.
• Alert on anomalous session activity, such as mass record exports, immediately following lead view events.

How to Mitigate CVE-2026-48540

Immediate Actions Required

• Restrict lead creation and edit permissions to trusted users until a patched release is deployed.
• Audit existing lead titles for template delimiters and remove or sanitize any suspicious entries.
• Rotate session tokens and credentials for users who may have viewed malicious leads.

Patch Information

No vendor patch is referenced in the advisory data at the time of publication. Monitor the Krayin CRM project and the VulnCheck advisory for a fixed release beyond version 2.2.6. Apply the vendor update as soon as it becomes available.

Workarounds

• Deploy a strict Content Security Policy that disallows unsafe-eval, which Vue's runtime template compilation relies on, to break the exploitation primitive.
• Add a server-side input filter that rejects or encodes {{ and }} sequences in the lead title field before persistence.
• Switch Krayin's Vue build to the runtime-only distribution that excludes the template compiler, eliminating client-side template evaluation of stored content.

# Example nginx snippet enforcing a restrictive CSP for the Krayin CRM origin
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'" always;