Frappe ERPNext CVE-2026-109653

Exploitation requires an authenticated low-privilege ERPNext account (PR:L) with the ability to create or edit a record whose field is rendered into an HTML attribute context without escaping. The payload is inert until a higher-privileged user passively opens the affected page (UI:P) - this victim interaction is the primary limiting factor, as the attacker cannot self-trigger execution. Affected deployments are ERPNext before 15.119.0 and 16.x before 16.31.0; patched versions are not vulnerable. There is no indication the flaw depends on a non-default configuration - it stems from the default field-rendering behavior.

This is a credible, actionable priority for organizations running ERPNext, though not an emergency. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H) scores 8.5 (High): network-reachable, low attack complexity, but it requires an attacker to already hold a low-privilege authenticated account (PR:L) and requires passive victim interaction (UI:P) - a privileged user must open the affected page for the stored payload to fire. No EPSS score was provided in the input, so exploitation-probability modeling cannot be performed. The CVE is NOT listed in CISA KEV and no public exploit or POC is indicated in the references (only vendor/VulnCheck advisories), so there is no evidence of active exploitation. No SSVC decision data was supplied. The signals are internally consistent - a stored XSS leading to account takeover genuinely warrants High, but the dual gating of PR:L plus UI:P means exploitation depends on an insider/low-trust account and a privileged user viewing attacker-controlled data, which moderates real-world urgency relative to an unauthenticated RCE of the same score.

An attacker with a low-privilege ERPNext account stores a malicious script inside a record field (e.g. a text field that is later rendered into an HTML attribute without escaping). When an administrator or other privileged user opens the page containing that record, the payload executes in their browser session, letting the attacker hijack the session and take over the privileged account. No public POC or exploit code is identified at time of analysis.