CVE-2026-109612
Frappe ERPNext report view stored XSS lets authenticated users execute script (CVE-2026-109612)
Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 has stored cross-site scripting in report views. Authenticated users who can create records can save names that execute script when another user opens the report. Upgrade to 15.120.0 or 16.33.0.
What happened
ERPNext's report view inserts stored record names into page markup without escaping them. An authenticated user with permission to create records can save a crafted name containing script. When another user later opens that report view, the script runs in their ERPNext session.
The issue is reachable over the network. The attacker needs only a low-privileged account; the victim's normal act of opening a report triggers the code. The CVSS 4.0 base score is 8.5, high, with high confidentiality and integrity impact in the victim's session and no availability impact.
There is no reported exploitation, and CISA's Known Exploited Vulnerabilities catalogue does not list the flaw.
Who is affected
ERPNext versions before 15.120.0 are affected. The 16.x line is affected from 16.0.0-beta.1 up to but not including 16.33.0. ERPNext is an enterprise resource planning application; the affected function is the report view, which authenticated users open during normal work.
What to do now
No vendor workaround is published in the advisory.
- Upgrade ERPNext to a fixed release: 15.120.0 for versions before 15.120.0, or 16.33.0 for 16.x versions.
- Confirm all connected instances are updated, including staging and development.
- Until the upgrade is applied, restrict record creation privileges for users who do not need them, since crafted record names are the stored input at the root of this flaw.
Beyond the patch
Beyond the immediate upgrade, this is a dependency problem: ERPNext is vendor software whose patch speed determines your exposure. Tracking the applications you run and how quickly their maintainers fix stored XSS is supply-chain risk management, which Supply Chain Defense & Third-Party Risk addresses. If your ERPNext instance is browser-facing or shared with partners, Implementation & Assessment Services can run a penetration test and hardening review of report views and similar stored-input paths before the next issue is abused.
Affected and fixed versions
| Product | Affected | Fixed in |
|---|---|---|
| erpnext | – < 15.120.0 16.0.0-beta.1 – < 16.33.0 | 15.120.0 16.33.0 |