EUVD-2026-34158
GHSA-hc32-c5xw-9f2m
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (Fluid Attacks) · only source for this CVE.
CVSS VectorVendor: Fluid Attacks
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
An authenticated ERPNext user with Item record edit permissions can persist arbitrary HTML/JavaScript in the item_name, description, or image fields of an Item and trigger unescaped rendering in the Point of Sale (POS) cart interface for every operator who adds that item to a transaction.This issue affects ERPNext: 16.16.0.
AnalysisAI
Stored cross-site scripting in ERPNext 16.16.0 allows an authenticated user holding Item record edit permissions to persist malicious HTML/JavaScript in the item_name, description, or image fields, which executes unescaped in the Point of Sale (POS) cart interface for any operator who subsequently adds that item to a transaction. Reported by Fluid Attacks (EUVD-2026-34158), this is a stored XSS with lateral impact across all POS operator sessions exposed to the poisoned item record. No public exploit code has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog; the CVSS 4.0 score of 4.8 reflects the constrained attack surface imposed by high privilege prerequisites and required passive user interaction.
Technical ContextAI
ERPNext is an open-source enterprise resource planning platform built on the Frappe framework (CPE: cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*). The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-Site Scripting): specifically, the Stored XSS variant, where attacker-controlled input is persisted to the database and later rendered without HTML entity encoding in a separate browsing context. The affected rendering surface is the Point of Sale cart interface, which reads and displays item fields (item_name, description, image) directly from stored Item records without applying output encoding, allowing injected script payloads to execute within the POS operator's browser session each time the item is added to a transaction.
RemediationAI
No vendor-released patch version has been independently confirmed from the available input data - the upstream Frappe GitHub repository at https://github.com/frappe/erpnext should be monitored for commits or tagged releases addressing this stored XSS, and the Fluid Attacks advisory at https://fluidattacks.com/es/advisories/pink should be consulted for patch confirmation. As a compensating control, restrict Item record edit permissions to the smallest possible set of highly trusted administrators, directly limiting who can introduce malicious payloads; note this trade-off may impact catalog management workflows. Additionally, perform an audit of existing Item records in ERPNext 16.16.0 deployments - specifically inspecting item_name, description, and image fields for injected script content - before assuming a clean state. If POS operations cannot be suspended pending a patch, consider limiting POS operator exposure by restricting the item catalog visible in POS sessions to a pre-vetted subset.
Stored cross-site scripting leading to code execution in Frappe Framework 15.89.0 (and the ERPNext application built on
An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Rated high severity (CVS
An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Rated high severity (CVS
An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Rated high severity (CVS
An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Rated high severity (CVS
An SQL injection vulnerability exists in the frappe.desk.reportview.get functionality of ERPNext 11.1.38. Rated high sev
In Frappe ERPNext 15.57.5, the function get_rfq_containing_supplier() at erpnext/buying/doctype/request_for_quotation/re
In Frappe ERPNext 15.57.5, the function get_stock_balance_for() at erpnext/stock/doctype/stock_reconciliation/stock_reco
In Frappe ERPNext 15.57.5, the function get_blanket_orders() at erpnext/controllers/queries.py is vulnerable to SQL Inje
In Frappe ERPNext 15.57.5, the function get_material_requests_based_on_supplier() at erpnext/stock/doctype/material_requ
A Cross-Site Request Forgery (CSRF) vulnerability was discovered in ERPNEXT 14.82.1 and 14.74.3. Rated high severity (CV
In Frappe ERPNext v15.57.5, the function get_stock_balance() at erpnext/stock/utils.py is vulnerable to SQL Injection, w
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today