ERPNext stored XSS in tool view runs script in victims' sessions (CVE-2026-109604)

What happened

ERPNext's tool view interpolates stored record names into page markup without escaping them. An authenticated user with low privileges can create a record with a malicious name, and when another user opens that tool, the script runs in that user's session.

The CVSS 4.0 score is 8.5, high severity: the attack is reachable over the network, has low complexity, requires low privileges and passive user interaction, and can compromise confidentiality and integrity for the victim session. The CVE record does not report active exploitation, and no public exploit activity is recorded.

Who is affected

Affected versions are ERPNext before 15.112.0 and the 16.x line from 16.0.0-beta.1 to before 16.23.0. ERPNext is typically a centrally hosted ERP, so the tool view is usually opened by employees or other authenticated users. The risk is highest where many authenticated users can create records and where one person's session can access sensitive functions or data. If your instance is on a release below one of the fixed versions, you are in the affected range.

What to do now

1. Inventory ERPNext instances and confirm whether they run a release before 15.112.0 or a 16.x release before 16.23.0.
2. Upgrade to the fixed release: erpnext 15.112.0 for the 15.x line, or erpnext 16.23.0 for the 16.x line.
3. No workaround has been published. Until upgrading is possible, limit record-creation rights to trusted users and monitor the affected tool view for records with names containing HTML or JavaScript.
4. After upgrading, verify that malicious record names are cleaned or neutralised before they can be rendered.

How to detect it

The GitHub advisory and the CVE record do not list specific indicators of compromise. Because the vector is a malicious record name, review recently created or modified records in the affected tool for names containing angle brackets, script tags, or JavaScript event handlers. Review access logs for authenticated users opening that tool at unusual times; this is not conclusive on its own, but it can help scope an investigation.

Beyond the patch

Stored XSS is a validation failure that often slips past functional testing because the record looks normal to the creator and only misbehaves for the next user. If ERPNext is accessible to suppliers, partners, or customers who can create records, an application penetration test and hardening review can catch this before deployment. Implementation & Assessment Services provides that testing, and Supply Chain Defense & Third-Party Risk can help track patch exposure across third-party products such as ERPNext.