EUVD-2026-86445
GHSA-h553-45jf-2pr4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to Krayin CRM as low-privilege user
-
DeliveryInject Vue template expression into person name field
-
ExploitPayload stored in contact record
-
ExecutionVictim opens affected person record
-
PersistVue compiler reaches Function constructor
-
ImpactAttacker JavaScript runs in victim origin
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated Krayin CRM account (any user able to create/edit a person/contact record) to inject the malicious name, AND a second victim user must subsequently VIEW the affected person record for the script to fire - this victim interaction (UI:P) is the primary limiter. The specific trigger is Vue.js double-brace template syntax in the person name field reaching the client-side Vue template compiler (client-side template injection / prototype-chain traversal to the Function constructor); deployments on Krayin CRM version 2.2.6 or earlier are affected. Impact is confined to the application origin in the browser - no direct server-side code execution. |
| Impact | This is a genuine but moderate-severity issue, correctly rated MEDIUM (vendor CVSS 4.0 5.1). The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N) tells a consistent story: network-reachable but requires an authenticated attacker (PR:L) and victim interaction (UI:P - a second user must view the poisoned person record). Because the payload is stored and executes in every viewer's browser within the app origin, the 4.0 subsequent-system metrics (SC:L/SI:L) capture the client-side blast radius rather than any direct server compromise (VC/VI/VA:N). No EPSS score, KEV listing, or SSVC decision data was supplied, so automatability and exploitation-status signals are absent. The VulnCheck advisory plus a dedicated aaronamran CVE-Disclosures GitHub repo strongly imply working exploit/PoC detail is public, but there is NO evidence of active exploitation. Net: this is a real, patch-worthy stored-XSS/CSTI issue for Krayin deployments, but not a drop-everything emergency - it is gated by authentication and victim viewing, and the affected product has a niche footprint. |
| Exploit ScenarioDerived | An authenticated Krayin CRM user (e.g., a low-privilege sales rep) creates or edits a contact and sets the person name to a Vue.js template expression using double-brace syntax that traverses the prototype chain to reach the Function constructor. When any other user - including an admin - later opens that person record, the injected JavaScript executes in their browser within the application origin, enabling session theft or actions on their behalf. Public disclosure detail (VulnCheck advisory and the aaronamran CVE-Disclosures repo) appears to document the payload, lowering the bar to reproduce. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 24, 2026
Stored client-side template injection in Krayin CRM through version 2.2.6 lets any authenticated user who can create or edit a person record plant Vue.js double-brace expressions in the name field, which the client-side Vue template compiler later evaluates in the browser of any other user who opens that record. Successful exploitation results in arbitrary JavaScript execution in the Krayin application origin, allowing theft of data or session material available to the viewing user, but it requires a low-privileged authenticated account to persist the payload and a second user to view the poisoned record, keeping the practical risk at medium severity (vendor CVSS 4.0 5.1; independent assessment CVSS 3.1 5.1). Impact is confined to the victim's browser on the CRM origin with no direct server-side code execution, and there is no public exploit identified at time of analysis and no confirmed active exploitation.
RemediationAI
No vendor-released patch was identified at time of analysis and no exact fix version is supplied in the available data, so the first step is to check the Krayin CRM release channel and the VulnCheck advisory (https://www.vulncheck.com/advisories/krayin-crm-stored-template-injection-xss-via-contact-name-field) for a patched build and upgrade as soon as one is published. Until then, the most direct control is to neutralize template delimiters on the person/contact name field - strip or HTML-escape sequences such as {{ and }} on both create and update paths, and render names as inert text (v-text or plain string interpolation) instead of routing user content into any code path that reaches the Vue template compiler; the trade-off is that legitimate names or imported records containing double braces will be rejected or altered, so pair the validation with a sweep of existing records to find already-stored payloads. A more durable fix is to build and ship the front end using Vue's runtime-only bundle, which removes the client-side template compiler entirely and eliminates this class of bug, but that requires precompiled components and a full regression pass before deployment. As defense in depth, deploy a Content-Security-Policy on the CRM origin that disallows 'unsafe-inline' script execution so an injected payload cannot run even if a record is poisoned, accepting that this can break inline scripts and third-party widgets unless nonces or hashes are adopted and tested. Restricting which roles may create or edit person records and monitoring for person names containing brace characters will reduce or detect exploitation but do not remove the underlying issue; consult the researcher disclosure at https://github.com/aaronamran/CVE-Disclosures/tree/main/CVE-2026/CVE-2026-48541 for any updated proof-of-concept details or vendor response.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-79 (improper neutralization of input during web page generation), manifesting here specifically as stored client-side template injection rather than classic HTML XSS. Krayin CRM is a Laravel-based PHP application whose front end is built on Vue.js; when the person/contact name field is stored and later rendered in a context that is handed to Vue's runtime template compiler instead of being emitted as inert text, any double-brace delimiters the attacker supplies are treated as live template expressions and evaluated at render time. The described exploitation path abuses Vue's expression evaluation to walk the JavaScript prototype chain and recover the Function constructor, which is then used to compile and run attacker-supplied JavaScript in the application's origin - meaning the payload executes with the CRM's origin privileges and any same-site cookies, tokens, or data readable from that context. The distinguishing factor between this and ordinary reflected XSS is that encoding the value at output does not help if the value flows into template compilation; the fix has to either prevent the compiler from ever seeing user-controlled delimiters or remove the compiler from the client bundle. The CPE string cpe:2.3:a:krayin:laravel-crm:*:*:*:*:*:*:*:* covers the whole Laravel CRM product line without version pinning, which is consistent with a defect in the contact module itself (shared across 2.x releases) rather than in an optional component; the flaw only triggers when the vulnerable field reaches the Vue compiler in another user's browser session, which is why the CVSS 4.0 vector carries UI:P and a changed scope (SC:L/SI:L) rather than a higher confidentiality or integrity rating.
Know when Krayin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Authenticated attacker stores payload (PR:L) that fires only when another user views the record (UI:R), executing across a security boundary into the victim's session (S:C) with limited C/I impact typical of XSS.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the person name field. Attackers can craft a person name containing double-brace template syntax that reaches the Vue template compiler, enabling prototype chain traversal to retrieve the Function constructor and execute attacker-supplied JavaScript in the application origin for every user who views the affected person record.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Administrative account takeover in Krayin CRM (Laravel CRM) 2.2.4 lets unauthenticated remote attackers overwrite the pr
Blind SQL injection in Krayin CRM's leads DataGrid allows any authenticated user with leads access to exfiltrate the ent
Broken object-level authorization in Krayin CRM (Laravel CRM) through version 2.2.3 lets any authenticated user tamper w
Unauthenticated remote users can still reach the installer and admin-config-setup endpoints of Krayin CRM (laravel-crm)
Missing authentication on Krayin CRM's admin mail ingest route lets any remote, unauthenticated attacker POST crafted RF
Improper privilege management in Krayin laravel-crm up to and including 2.2.5 lets an authenticated back-office user who
An insecure direct object reference (IDOR) in Krayin laravel-crm through version 2.2.5 allows any authenticated user to
Improper access control in Krayin Laravel CRM through 2.2.5 allows an authenticated low-privilege admin user to access a
Cross-site scripting in Krayin Laravel CRM through 2.2.5 lets an authenticated user with access to the admin configurati
Stored cross-site scripting (XSS) in Krayin Laravel-CRM up to version 2.2 allows authenticated users with low privileges
Stored cross-site scripting in Krayin CRM (laravel-crm) up to and including version 2.2.5 lets an authenticated administ
Stored cross-site scripting in Krayin laravel-crm (versions up to and including 2.2.5) lets an authenticated user with a
Exploit-DB