Krayin CRM EUVD-2026-86446

Requires a valid authenticated CRM account with permission to create or edit products (PR:L), and exploitation completes only when another user opens the affected product record (UI:P/passive). The specific trigger is the product name field, whose value reaches the Vue.js client-side template compiler unescaped, allowing double-brace template expressions to be evaluated; deployments are affected in default configuration up to and including Krayin CRM 2.2.6. Limiting factors: attacker must first authenticate, impact is confined to the browser/app origin of viewing users, and there is no direct server-side compromise or availability impact.

This is a genuine but moderate-priority issue, not an overblown high-CVSS finding. The vendor CVSS 4.0 base is 5.1 (medium), and the vector is internally consistent with the description: network-reachable (AV:N), low complexity (AC:L), but requiring low-privilege authentication (PR:L) and passive victim interaction (UI:P), with only limited subsequent-system confidentiality/integrity impact (SC:L/SI:L) and no availability impact. There is no EPSS score, no CISA KEV listing, and no public POC referenced, so the exploitation status is 'no public exploit identified at time of analysis' - this is not evidence of active exploitation. The real elevator here is that it is STORED and client-side template injection escalating to arbitrary JS via the Function constructor, meaning the payload executes in the application origin for every user who views the poisoned product record, effectively giving a low-privileged CRM user a path to run script in higher-privileged users' sessions. That session-hijack/lateral-movement potential is more serious than the 5.1 base implies, but it remains gated behind valid authentication and a victim viewing the record, keeping it a medium concern rather than a critical one. Note a data caveat: one of the two references points to CVE-2026-48541 (an apparent sibling), not this CVE, so cross-reference against the VulnCheck advisory directly.

A low-privileged authenticated Krayin CRM user creates or edits a product and sets its name to a Vue.js double-brace template expression that traverses the prototype chain to reach the Function constructor and run attacker JavaScript. When any other user - including an admin - opens that product record, the payload executes in the application origin, enabling session token theft, CSRF-style actions, or account takeover. No public exploit code is referenced, though VulnCheck's advisory documents the technique.