CVE-2026-93454: Aureus ERP XSS Vulnerability

CVE-2026-93454 Overview

CVE-2026-93454 is a stored Cross-Site Scripting (XSS) vulnerability affecting Aureus ERP through version 1.6.0. The Accounting plugin stores the Payment Term note field without sanitization and renders it as raw HTML. Authenticated users with payment-term create permission can submit arbitrary JavaScript to the payment-terms endpoint. The payload persists to the database and executes in the browser of any user who later views the affected Payment Term record. The flaw is tracked under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
An authenticated low-privilege user can persist JavaScript that executes in every viewer's browser, enabling session theft, account takeover, and unauthorized actions in the accounting workspace.

Affected Products

Aureus ERP versions up to and including 1.6.0
Aureus ERP Accounting plugin (webkul/accounts)
The PaymentTermResource component, specifically PaymentTermInfolist.php

Discovery Timeline

2026-09-18 - CVE-2026-93454 published to the National Vulnerability Database
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-93454

Vulnerability Analysis

Aureus ERP is a Laravel and Filament-based open-source ERP platform. The Accounting plugin exposes a Payment Term resource where administrators define invoice payment schedules. The note field on this resource captures free-form description text.

The application persists the raw note value to the database without HTML encoding or sanitization. When a user opens the Payment Term detail view, the PaymentTermInfolist schema renders the stored value as raw HTML instead of escaped text. Any script tags or event handlers embedded in the note execute in the viewer's authenticated session.

Because the payload is stored server-side, the attack persists across sessions and affects every user who loads the record. The impact scales with role privileges, since accounting users often hold sensitive financial and administrative permissions.

Root Cause

The root cause is the use of a raw HTML rendering component in the PaymentTermInfolist schema for the note attribute, combined with the absence of output encoding at the storage or presentation layer. Filament infolists support both escaped text and raw HTML rendering; the vulnerable code path uses the latter without invoking a sanitizer such as HTMLPurifier.

Attack Vector

Exploitation requires an authenticated account with payment-term create or edit permission. The attacker submits a crafted payload to the payment-terms endpoint via the standard Filament resource form. The malicious content is stored in the payment_terms.note column. When any administrator, accountant, or auditor opens the affected Payment Term record, the browser parses and executes the injected script under the victim's session context.

Exploitation code is not required beyond standard form submission. Details are documented in the HackMD analysis and the VulnCheck advisory. No public exploit tooling is currently listed.

Detection Methods for CVE-2026-93454

Indicators of Compromise

Payment Term note fields containing <script>, <img onerror=>, <svg onload=>, or other active HTML constructs.
Unexpected outbound requests from browser sessions of accounting users to attacker-controlled domains after viewing Payment Term records.
Newly created Payment Term records authored by low-privilege users who do not normally manage accounting configuration.

Detection Strategies

Query the payment_terms table for note values matching HTML tag patterns or JavaScript URI schemes such as javascript:.
Review Laravel application logs and audit trails for POST and PUT calls to the payment-terms endpoint with suspicious payload lengths or entities.
Correlate creation of Payment Term records with subsequent authenticated session anomalies for viewers of those records.

Monitoring Recommendations

Enable Content Security Policy (CSP) reporting to capture script-source violations originating from ERP pages.
Alert on modifications to accounting reference data performed by non-finance roles.
Monitor web application firewall (WAF) logs for XSS signatures targeting /admin or Filament resource paths.

How to Mitigate CVE-2026-93454

Immediate Actions Required

Upgrade Aureus ERP to the release that incorporates Pull Request #1562, which addresses the unsafe rendering.
Audit existing Payment Term records and remove or sanitize any note values containing HTML or script content.
Review and restrict payment-term create and edit permissions to trusted accounting personnel only.

Patch Information

The upstream fix is available in the Aureus ERP repository via Pull Request #1562. Administrators running version 1.6.0 or earlier should upgrade to the patched release referenced in the VulnCheck Advisory and the Aureus ERP GitHub repository.

Workarounds

Modify the PaymentTermInfolist schema to render the note field as escaped text rather than raw HTML.
Apply server-side sanitization to the note input using a vetted HTML sanitizer before persistence.
Deploy a strict Content Security Policy that disallows inline scripts on the ERP administrative interface.

bash

# Configuration example
# Add a strict Content Security Policy header via Laravel middleware
# in app/Http/Middleware/ContentSecurityPolicy.php
header("Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'");