EUVD-2026-86383
GHSA-jf9p-cp2g-2745
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged CRM user
-
DeliveryInject Vue template expression into lead title
-
ExploitPayload stored on lead record
-
ExecutionVictim views affected lead
-
PersistVue compiler evaluates expression via Function constructor
-
ImpactArbitrary JavaScript runs in victim's session origin
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated account on the Krayin CRM instance (PR:L) with permission to create or edit leads, and it requires a second user to subsequently view the malicious lead record (UI:P) for the payload to execute. The payload must use Vue.js double-brace template syntax that reaches the client-side Vue template compiler in the lead title field; the injection is persistent/stored, so every user who views the affected lead is impacted. Limiting factors: no code executes without a victim viewing the record, the attacker needs valid credentials, impact is confined to the browser origin (no server RCE), and only Krayin CRM versions through 2.2.6 are affected. |
| Impact | This is a moderate, not top-tier, priority. The CVSS 4.0 base score of 5.1 (AV:N/AC:L/AT:N/PR:L/UI:P) reflects the two factors that cap real-world risk: the attacker must already be an authenticated user of the Krayin CRM instance (PR:L), and a victim must passively view the poisoned lead record (UI:P) for the payload to fire. Impact is confined to limited confidentiality and integrity in the victim's browser within the application origin (VC:N/VI:N/VA:N but SC:L/SI:L) - there is no direct server-side compromise. No EPSS score, no CISA KEV listing, and no SSVC decision data were supplied, so automatable/exploitation-status signals cannot be cross-referenced. One of the two references is a public CVE-Disclosures repository, which for this class of disclosure typically includes a working reproduction, so exploit detail is likely public even though no formal POC/KEV flag was provided in the input. Net: a real but bounded stored-XSS/CSTI issue best treated as a standard patch-cycle item rather than an emergency, weighted up slightly if the CRM handles sensitive lead/customer PII and has many interactive users. |
| Exploit ScenarioDerived | An authenticated low-privileged sales user creates or edits a lead and sets its title to a Vue.js template expression using double-brace syntax that resolves the Function constructor via prototype-chain traversal. When a manager or colleague opens that lead record, the injected expression is compiled by the Vue template compiler and the attacker's JavaScript executes in the victim's browser under the CRM's origin. A public disclosure/reproduction appears to exist via the referenced CVE-Disclosures GitHub repository. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 24, 2026
Stored client-side template injection in Krayin CRM through 2.2.6 lets an authenticated user who can create or edit leads embed Vue.js double-brace template expressions in a lead's title field, which then execute as arbitrary JavaScript in the browser of any user who opens the poisoned record. The injected expressions reach the client-side Vue template compiler, allowing prototype-chain traversal to the Function constructor and code execution in the application origin, so every subsequent viewer of the lead is affected until the record is sanitized. Exploitation requires valid CRM credentials with lead privileges plus a victim who views the record, and is confined to the browser origin with no server-side code execution; no public exploit code and no confirmed active exploitation (not listed in CISA KEV) were identified at time of analysis, and this is assessed as a moderate, not top-tier, priority.
RemediationAI
No vendor-released patch version is identified in the available advisory data for CVE-2026-48540; the referenced VulnCheck advisory (https://www.vulncheck.com/advisories/krayin-crm-stored-template-injection-xss-via-lead-title) and the disclosure repository (https://github.com/aaronamran/CVE-Disclosures/tree/main/CVE-2026/CVE-2026-48540) should be monitored for a fixed release, and because versions through 2.2.6 are reported as vulnerable, a release beyond 2.2.6 is the expected remediation path once an upgrade is confirmed to address this flaw. Until that patch is confirmed, the highest-value action is to stop user-controlled lead titles from reaching the Vue template compiler, i.e. render the lead title as inert text (v-text or interpolation of an already-escaped string) instead of via v-html or dynamic template compilation; the trade-off is that this is a code change and may break any legitimate formatting or templating currently applied to that field. As an interim operational control, restrict the ability to create or edit leads to a small set of trusted roles, which shrinks the pool of potential injectors but does not protect the many users who view leads, and audit and clean existing lead titles for double-brace {{ }} patterns. A Content Security Policy without 'unsafe-inline' and, where feasible, without 'unsafe-eval' blocks the Function-constructor execution path, though disabling 'unsafe-eval' can break Vue's runtime template compilation and other dynamically compiled front-end code and must be validated in staging. Because the script runs in the application origin with the victim's session context, HttpOnly and SameSite cookie flags reduce credential theft after execution but do not stop the script from acting as the victim inside the CRM, so they should be treated as supplementary rather than primary mitigations.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CVE-2026-48540 is a client-side template injection variant of CWE-79 (improper neutralization of input during web page generation leading to cross-site scripting) in Krayin CRM, an open-source Laravel-based CRM with a Vue.js front end. The root cause is that the lead title field is rendered through the Vue template compiler instead of being emitted as inert text, so contained {{ ... }} double-brace syntax is evaluated as a template expression rather than displayed literally. The documented escalation path is prototype-chain traversal from the component rendering context to the JavaScript Function constructor (for example a constructor.constructor('...')() style payload), which evaluates an attacker-supplied string as script inside the page origin. Because the payload is stored in the lead record on the server, it is persistent and re-triggers for each viewer, distinguishing it from reflected XSS. The reported CPE cpe:2.3:a:krayin:laravel-crm:*:*:*:*:*:*:*:* carries no version bounds in the feed, while the advisory text identifies versions through 2.2.6 as affected. The supplied CVSS 4.0 score of 5.1 (AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N) is consistent with our independent CVSS 3.1 assessment (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N): low confidentiality and integrity impact, scope change to the browser origin, and no availability or server-side impact.
Know when Krayin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Authenticated attacker (PR:L) stores a payload that fires only when another user views the record (UI:R); execution in the browser origin distinct from injection privilege is a scope change (S:C) with limited C/I and no availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the lead title field. Attackers can craft a lead title containing double-brace template syntax that reaches the Vue template compiler, enabling prototype chain traversal to retrieve the Function constructor and execute attacker-supplied JavaScript in the application origin for every user who views the affected lead record.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Administrative account takeover in Krayin CRM (Laravel CRM) 2.2.4 lets unauthenticated remote attackers overwrite the pr
Blind SQL injection in Krayin CRM's leads DataGrid allows any authenticated user with leads access to exfiltrate the ent
Broken object-level authorization in Krayin CRM (Laravel CRM) through version 2.2.3 lets any authenticated user tamper w
Unauthenticated remote users can still reach the installer and admin-config-setup endpoints of Krayin CRM (laravel-crm)
Missing authentication on Krayin CRM's admin mail ingest route lets any remote, unauthenticated attacker POST crafted RF
Improper privilege management in Krayin laravel-crm up to and including 2.2.5 lets an authenticated back-office user who
An insecure direct object reference (IDOR) in Krayin laravel-crm through version 2.2.5 allows any authenticated user to
Improper access control in Krayin Laravel CRM through 2.2.5 allows an authenticated low-privilege admin user to access a
Cross-site scripting in Krayin Laravel CRM through 2.2.5 lets an authenticated user with access to the admin configurati
Stored cross-site scripting (XSS) in Krayin Laravel-CRM up to version 2.2 allows authenticated users with low privileges
Stored cross-site scripting in Krayin CRM (laravel-crm) up to and including version 2.2.5 lets an authenticated administ
Stored cross-site scripting in Krayin laravel-crm (versions up to and including 2.2.5) lets an authenticated user with a
Exploit-DB