ERPNext CVE-2026-42839

The attacker must hold an authenticated ERPNext account with Item record edit permissions - this is a high-privilege role (PR:H per CVSS vector), not accessible to standard or guest users. The victim must be a POS operator who passively triggers the payload by adding the maliciously crafted item to a Point of Sale cart transaction (UI:P per CVSS vector); simply browsing the item catalog outside the POS cart interface may not trigger execution, as the unescaped rendering is specifically identified in the POS cart surface. The vulnerability is confirmed only for ERPNext 16.16.0; behavior on other versions is not confirmed from available data. Exploitation is limited to environments where the POS module is in active use and where at least one user account with Item edit access is available to an attacker. Environments that do not use the ERPNext POS module are not exposed to the attack trigger path.

The CVSS 4.0 base score of 4.8 (Medium) reflects a well-bounded risk profile. The vector AV:N/AC:L/AT:N/PR:H/UI:P confirms network-reachable exploitation with low complexity and no special target conditions, but critically requires high privileges (PR:H - authenticated Item record editor) and passive user interaction (UI:P - a POS operator must add the item to a transaction). Impact is limited to low confidentiality and integrity on both the vulnerable system (VC:L, VI:L) and downstream scope (SC:L, SI:L) with no availability impact. No EPSS score was included in the input data, preventing probabilistic exploitation likelihood assessment. There is no CISA KEV listing and no public exploit code identified at time of analysis, indicating no confirmed widespread exploitation. Real-world risk is most elevated in organizations where POS operators represent a distinct, lower-trust population relative to catalog managers - the vulnerability enables a catalog editor to execute JavaScript in the session of every POS operator who processes a transaction involving the poisoned item, potentially enabling session token theft or unauthorized POS actions. The high-privilege prerequisite substantially limits opportunistic exploitation.

An authenticated ERPNext catalog manager (or an attacker who has compromised such an account) edits an Item record and embeds a JavaScript payload - such as a session cookie exfiltration script - into the item_name or description field before saving. When any POS operator subsequently adds that item to a cart during a sales transaction, the injected payload executes silently in the operator's browser, potentially exfiltrating their session token back to an attacker-controlled endpoint. No public exploit code has been identified at time of analysis, but the stored XSS pattern is well-understood and the attack requires no specialized tooling beyond a browser and a legitimate authenticated account.