CVE-2026-109673

Executive Summary

CVE-2026-109673 is a stored cross-site scripting (XSS) vulnerability in Frappe ERPNext affecting versions before 15.103.0 and 16.x before 16.12.0. Record names are not properly neutralized when rendered on certain dashboards, tools, and portals, allowing any authenticated user who can set a record name to persistently inject JavaScript that executes in the browsers of other users. Because the injection renders in shared and administrative interfaces, the flaw enables session/token theft, unauthorized data access, and modification of ERP records — a high business impact for organizations running ERPNext as a system of record.

Technical Analysis

The vulnerability is a persisted (stored) XSS class issue (CWE-79) rooted in improper output neutralization. According to the NVD description, "the names of certain records are not properly neutralized when rendered on some dashboards, tools, and portals." In ERPNext/Frappe, records are user- or application-created documents identified by a human-readable "name" field, and these identifiers are frequently echoed into UI surfaces such as dashboards, tools, and portals. Where that value is inserted into HTML without adequate context-aware encoding or sanitization, any HTML/JavaScript embedded in the record name is stored in the database and re-executed each time the value is rendered to a viewing user.

Key analytical points derived strictly from the available data:

• Injection vector: Record names. Because record names function as identifiers, an attacker who can create or influence a record name can persist a payload server-side. The description does not enumerate which specific record types or DocTypes are affected, so the precise set of injectable objects cannot be confirmed from the supplied data.
• Trigger surfaces: "Some dashboards, tools, and portals" — i.e., multiple rendering contexts where record names are displayed. Portals are notable because they are frequently exposed to external or lower-privileged audiences, while dashboards/tools are typically viewed by privileged operators.
• Root cause: Missing or insufficient neutralization (encoding/sanitization) of a stored value at render time. This is an output-context failure rather than an authentication or authorization flaw; authentication does not mitigate it.
• Access requirement: The CVSS vector indicates PR:L (Low privileges), confirming the attacker must be authenticated but needs only a low-privileged account. UI:R (User Interaction Required) reflects that a victim must view the affected dashboard/tool/portal for the payload to execute. S (Scope) is Unchanged, and the confidentiality and integrity impacts are High (C:H/I:H), consistent with script execution in a privileged user's session granting read and write access to ERP data. Availability impact is None (A:N).
• No public exploit code or Nuclei template exists at the time of writing, and the CVE has not been scored by FIRST.org EPSS, nor listed in CISA KEV. No affected-version package metadata beyond the stated version ranges was provided. Insufficient technical detail is available to identify specific function names, file paths, or parameters involved in the rendering pipeline.

Exploitation Scenarios

No public PoC is available; the following attack chain is inferred from the vulnerability class (stored XSS) and the NVD description. It deliberately avoids naming functions, endpoints, or parameters that are not stated in the source data.

1. Reconnaissance / target identification. The attacker identifies a target running Frappe ERPNext at a version below 15.103.0 (or 16.x below 16.12.0). Because ERPNext is typically internet- or intranet-exposed for employee, partner, and customer access, discovery can be as simple as fingerprinting the login page/portal. The attacker registers or is provisioned a low-privileged authenticated account (consistent with PR:L).

2. Triggering the flaw class. Using their authenticated account, the attacker creates or manipulates a record whose name contains an HTML/JavaScript payload. Per the NVD description, the affected record names are not neutralized when later rendered on certain dashboards, tools, and portals, so the payload is persisted (stored) rather than reflected.

3. Payload execution method (class level). When any other user — including privileged users — loads a dashboard, tool, or portal that renders the poisoned record name, the unescaped value is interpreted as active content and the embedded script executes in that victim's browser origin/session. Execution is therefore automatic on page view, requiring only that the victim visit the affected surface (UI:R). The description does not specify any additional filter-bypass or encoding techniques, so none are assumed.

4. Post-exploitation impact. Because the script runs in the victim's authenticated ERPNext session, the attacker can, per the CVE's stated impact, access data, modify records, and steal tokens/session material ("token theft"). Targeting privileged users is explicitly called out as a high-value outcome: script execution in an administrator's session can yield broad read/write reach across the ERP, escalating from a single low-privileged foothold to enterprise-wide data and workflow compromise.

Impact Assessment

The CVSS v3.1 base score is 7.3 (High), reflecting AV:N (network-reachable), AC:L (no special conditions), PR:L (authenticated low-privileged attacker), UI:R (victim must view an affected surface), S:U, and C:H/I:H/A:N. In practice:

• Affected systems: Any ERPNext deployment below 15.103.0 or 16.x below 16.12.0 that exposes dashboards, tools, or portals where record names are rendered.
• Blast radius: Because the payload is stored, a single malicious record name can affect an unbounded number of users who subsequently view the affected surface. Cross-tenant exposure is possible where portals are shared externally.
• Business impact: ERP systems are systems of record for finance, inventory, HR, CRM, and supply chain data. Script execution in privileged sessions can lead to unauthorized access to confidential business data (C:H), tampering with records and workflows (I:H), and session/token theft enabling account takeover persistence. Integrity compromise in an ERP can propagate to downstream financial reporting and automation.
• Likelihood: Exploitation requires only a low-privileged account and a victim viewing a page, placing the barrier to entry relatively low for an insider or any party able to obtain a valid account. No public exploit lowers immediate risk, but the attack surface is broad.

Detection Guidance

Sigma Rule

title: Potential Stored XSS Payload in Frappe ERPNext Record Name
id: 6b1f2a90-4e2c-4a7c-9d3e-1c0f5a7b8e21
status: experimental
description: Detects submission of HTTP requests to a Frappe ERPNext instance carrying script-like markup in parameters, consistent with attempts to store an XSS payload in a record name (CVE-2026-109673).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-109673
author: valtersit.com Threat Intelligence
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_method:
    cs-method:
      - POST
      - PUT
  selection_payload:
    - cs-uri-query|contains:
        - '<script'
        - '%3Cscript'
        - 'javascript:'
        - 'onerror='
        - 'onload='
    - cs-uri-query|contains|all:
        - 'name='
  condition: selection_method and selection_payload
falsepositives:
  - Legitimate administrative content containing markup-like text
  - Security scanners and fuzzing tools
level: medium
tags:
  - attack.t1059.007
  - cwe.79

YARA Rule

rule CVE_2026_109673_ERPNext_Stored_XSS
{
    meta:
        description = "Detects stored XSS payloads targeting Frappe ERPNext record names (CVE-2026-109673)"
        author = "valtersit.com Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-109673"
        date = "2026-01-01"
        cwe = "CWE-79"
    strings:
        $s1 = "<script" nocase
        $s2 = "</script" nocase
        $s3 = "javascript:" nocase
        $s4 = "onerror=" nocase
        $s5 = "onload=" nocase
        $s6 = "document.cookie" nocase
        $e1 = "erpnext" nocase
        $e2 = "frappe" nocase
    condition:
        uint16(0) == 0x3C3F or
        (2 of ($s*) and 1 of ($e*))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-109673 Frappe ERPNext Stored XSS Payload in Record Name"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"name="; nocase; content:"<script"; nocase; http.uri; content:"<script"; nocase; sid:2026109673; rev:1; reference:cve,2026-109673; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-109673; classtype:web-application-attack; metadata:service http;)

Elastic Detection

sequence by process.entity_id
  [process where event.action == "start" and process.parent.name : "python*"]
  [file where file.path : "*frappe*" and file.extension : ("py", "html", "json")]

Splunk SPL Query

index=web sourcetype=access_combined
| eval payload = lower(uri)
| where (method="POST" OR method="PUT")
| where (match(payload, "%3cscript|<script") OR match(payload, "onerror%3d|onerror=") OR match(payload, "javascript%3a|javascript:"))
| table _time, src_ip, method, uri, status, useragent
| sort - _time

Wazuh OSSEC Rule

<group name="web,erpnext,xss,">
  <rule id="2026109" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <url>name=</url>
    <match>%3Cscript|<script|javascript%3A|javascript:|onerror=</match>
    <description>CVE-2026-109673: Possible stored XSS payload targeting Frappe ERPNext record name</description>
    <mitre>
      <id>T1059.007</id>
    </mitre>
    <group>cve_2026_109673,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source confirmed). No vendor advisory, workaround, or patch source was supplied in the intelligence data.

1. Immediate mitigations.

   • Restrict access to affected dashboards, tools, and portals to trusted users where feasible; portals are a priority given their broader audience.
   • Apply a strict Content-Security-Policy (CSP) that disallows inline and untrusted script execution to reduce the impact of any stored payload that does reach a browser.
   • Deploy the web-layer detections above (Sigma/Suricata/Splunk/Wazuh) to flag script-like record name submissions.
   • Limit the ability of low-privileged users to create or rename records where business requirements permit; least-privilege applies directly to the PR:L attack condition.
   • Shorten session token lifetimes and enable re-authentication for sensitive operations to limit the value of token theft.

2. Patch/upgrade steps.

   • NVD states the issue is resolved in ERPNext 15.103.0 and 16.12.0. Upgrade to at least these versions on the respective release tracks (15.x → 15.103.0 or later; 16.x → 16.12.0 or later).
   • Because no vendor advisory was tracked, verify the fix against the official ERPNext/Frappe release notes before scheduling production rollout.
   • Inventory all deployments (including staging, partner, and self-hosted instances) and confirm no instance remains below the fixed versions.

3. Long-term hardening.

   • Enforce context-aware output encoding/sanitization for all user-controlled values (including record names) at every render surface; treat stored names as untrusted data.
   • Maintain a broad, restrictive CSP and regular XSS-focused code review for dashboards, tools, and portals.
   • Monitor NVD and the ERPNext/Frappe project channels for an official advisory and updated patch confidence.
   • If patch availability is delayed, deploy a reverse-proxy/WAF virtual patch that neutralizes inline script in stored values until an upgrade is possible.

References

• NVD — CVE-2026-109673: https://nvd.nist.gov/vuln/detail/CVE-2026-109673
• CWE-79 — Improper Neutralization of Input During Web Page Generation (Cross-site Scripting): https://cwe.mitre.org/data/definitions/79.html
• MITRE ATT&CK T1059.007 — Command and Scripting Interpreter: JavaScript: https://attack.mitre.org/techniques/T1059/007/
• Frappe ERPNext official project/release notes: https://github.com/frappe/erpnext
• CISA Known Exploited Vulnerabilities catalog (check current status): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-109673 in the supplied intelligence: no public PoC/exploit, no Nuclei template, no EPSS score, and no CISA KEV listing were reported.