Krayin CRM EUVD-2026-86448

Exploitation requires an authenticated Krayin CRM account (PR:L) with the ability to create or modify a web form, and specifically to control the web form's description field, which is rendered through the Vue.js template compiler without sanitizing double-brace expressions. The payload only fires when another user passively views the affected web form (UI:P), so it is a stored/second-order attack rather than a self-contained remote exploit. Limiting factors: an authenticated foothold with web-form editing rights is needed, a separate victim must render the form, and impact is confined to client-side JavaScript execution in the application origin (no direct server-side data compromise). Applies to Krayin CRM versions through 2.2.6.

This is a stored client-side template injection (Vue.js template injection resolving to XSS, CWE-79) in Krayin CRM through 2.2.6, reported by VulnCheck. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N, base 5.1) indicates a network-reachable but authenticated (PR:L) attack that requires passive victim interaction (UI:P) and yields no direct confidentiality/integrity/availability impact to the vulnerable system itself, only limited subsequent-system impact (SC:L/SI:L) - consistent with script execution in a victim's browser rather than server compromise. No EPSS score, no CISA KEV listing, and no public exploit code are present in the supplied intelligence, so exploitation status is 'no public exploit identified at time of analysis.' The signals are internally consistent: a medium-severity, authenticated stored-XSS in a niche open-source CRM. This is a genuine but moderate-priority issue - real because the payload persists and fires for every viewer of the affected web form, but bounded because it requires an authenticated foothold to plant the payload and the impact is client-side (session/action abuse in the app origin), not server RCE. No key signals are missing beyond the absence of EPSS/KEV/POC data, which limits confidence on real-world exploitation likelihood.

An authenticated Krayin CRM user with permission to create or edit a web form embeds Vue.js double-brace template syntax (e.g. an expression traversing the prototype chain to the Function constructor) into the web form description field. When any other user - including higher-privileged staff - views that web form, the Vue template compiler evaluates the expression and runs the attacker's JavaScript in the application origin, enabling session token theft, CSRF-style actions, or UI manipulation. No public proof-of-concept exploit is identified in the supplied data.