CVE-2026-48541

Executive Summary

CVE-2026-48541 is a stored client-side template injection (CSTI) vulnerability in Krayin CRM through version 2.2.6. An authenticated attacker can inject Vue.js double-brace template expressions into the person name field, which are then compiled by the client-side Vue template engine and executed as JavaScript in the browser of any user who views the affected person record. Successful exploitation yields arbitrary JavaScript execution in the application origin for every viewing user, enabling session theft, credential harvesting, and actions performed with the victim's privileges, though the attack requires the victim to interact with (view) the malicious record.

Technical Analysis

The vulnerability class here is client-side template injection (CSTI), a variant of cross-site scripting (CWE-79) in which the injection point is not an HTML sink directly but a JavaScript client-side template compiler. Krayin CRM is a Laravel-based application whose frontend uses Vue.js. Vue compiles template syntax found in the DOM — most notably the mustache-style double-brace interpolation {{ ... }} — into executable render functions.

Per the NVD description, user-controlled data (the person name field) is rendered in a context where it reaches the Vue template compiler rather than being treated as inert text. When double-brace syntax is present in that field, Vue parses and evaluates the enclosed expression. Because Vue template expressions are evaluated in JavaScript, an attacker who controls the expression can traverse the JavaScript prototype chain to obtain the Function constructor and from there execute arbitrary JavaScript. This is the classic CSTI escalation path: template interpolation context → property/prototype access → Function constructor → dynamic code execution.

Two properties make this a meaningful vulnerability:

1. Persistence/stored nature — the payload is saved in a person record. It is therefore re-triggered for every user who subsequently views the affected record, not just the original submitter.
2. Execution in the application origin — Vue expressions are evaluated within the context of the vulnerable page, so resulting script runs in the origin of the Krayin CRM deployment, granting access to that origin's cookies (subject to HttpOnly/SameSite flags), DOM, and same-origin API surface.

The attack surface is any authenticated user with the ability to create or edit person records (person name field). The NVD description explicitly names the "person name field" as the injection vector; no other fields, endpoints, file paths, or parameter names are specified in the source data, and none are invented here.

Relevant CVSS vector interpretation: network-exploitable (AV:N), low attack complexity (AC:L), requires low privileges (PR:L — an authenticated account), requires user interaction (UI:R — a victim must view the record), scope-changed (S:C — code executes in other users' browsers/origin), low confidentiality and integrity impact (C:L/I:L), and no availability impact (A:N). These reflect a real but constrained stored-XSS-class issue rather than a full RCE or CVSS-critical vulnerability.

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template is available for CVE-2026-48541. The attack chain below is inferred at the vulnerability-class level from the NVD description; specific code payloads or internal function names beyond those stated in the description are not asserted.

1. Reconnaissance / target identification. The attacker identifies a Krayin CRM instance running version 2.2.6 or earlier. Because exploitation requires authentication (PR:L), the attacker first obtains a valid low-privileged account (legitimate access, shared credentials, or a separately acquired account). The target of interest is the person-record management functionality and the person name field.

2. Triggering the flaw class. The attacker creates or edits a person record and supplies a person name containing Vue.js double-brace template expression syntax. Because the application does not neutralize template metacharacters before the value reaches the Vue template compiler, the injected expression is compiled and evaluated when the record is rendered — rather than being displayed as a literal string.

3. Payload / execution method (vulnerability-class level). The injected expression is crafted so that, during Vue's evaluation of the interpolation, it traverses the JavaScript prototype chain to reach the Function constructor and invokes it with attacker-supplied JavaScript. Execution occurs in the application origin. Per the NVD description, this is the mechanism by which "prototype chain traversal to retrieve the Function constructor" enables "execution of attacker-supplied JavaScript." No specific literal payload text is available and none is fabricated here.

4. Post-exploitation impact. Because the payload is stored in the record, it fires for every authenticated user who views the affected person record, not only the victim who was targeted first. The executing script runs in the Krayin application origin and can act with the viewing user's session context — reading accessible page data, performing same-origin API actions with the victim's privileges, and, where cookies are readable, attempting session-related theft. The CVSS scope-change (S:C) and C:L/I:L subscores reflect impact that may cross into the viewing user's browser/origin context while confidentiality and integrity effects are partial and no availability impact is scored.

Impact Assessment

Business impact. A stored CSTI/XSS in a CRM is significant because CRM systems aggregate sensitive customer, contact, and deal data, and are frequently accessed by higher-privileged staff (sales, management, administrators). A single malicious person record becomes a persistent watering-hole for the tenant: every internal user who opens that record risks executing attacker JavaScript in the CRM origin. This weakens the trust boundary around customer PII and internal communications and can be leveraged for credential/session harvesting and unwanted same-origin actions performed as the viewing user.

Affected systems. Krayin CRM deployments at version 2.2.6 and earlier. The product is Laravel/Vue-based. Because no OSV package data or affected-version ranges are published, all deployments at or below 2.2.6 should be considered in scope until a fix is confirmed.

Blast radius. The stored payload is re-triggered per view, so blast radius scales with the number of users who access the affected record and with how long the record remains. Scope-change in the CVSS vector reflects potential spillover from the server-rendered context into the browser origin of each viewer. However, the impact is bounded: confidentiality and integrity are rated Low (C:L/I:L), there is no availability impact (A:N), preconditions include authenticated write access (PR:L) and victim interaction (UI:R), and CVSS base is 5.4 (Medium). No evidence of exploit-in-the-wild, CISA KEV listing, or active threat-actor campaign exists in the provided data.

EPSS note. No EPSS score has been published by FIRST.org for this CVE. No value is fabricated.

Detection Guidance

Sigma Rule

title: Krayin CRM Stored Client-Side Template Injection via Person Name (CVE-2026-48541)
id: 6f0f2a3e-4854-4c11-9d6e-48541krayin01
status: experimental
description: Detects submission of person-name values containing Vue.js double-brace template syntax indicative of CSTI attempts against Krayin CRM (CVE-2026-48541).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-48541
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
  product: generic
detection:
  selection_method:
    cs-method:
      - 'POST'
      - 'PUT'
      - 'PATCH'
  selection_uri:
    cs-uri-stem|contains:
      - 'person'
      - 'persons'
      - 'contact'
  selection_body:
    cs-uri-query|contains:
      - '{{'
      - '}}'
      - 'constructor'
      - 'Function('
  condition: selection_method and (selection_uri and selection_body)
fields:
  - c-ip
  - cs-uri-stem
  - cs-uri-query
  - cs-user-agent
falsepositives:
  - Legitimate user names containing literal double braces (rare)
  - Security scanners and automated fuzzing tools
level: medium
tags:
  - attack.t1059.007
  - cve.2026.48541

YARA Rule

rule CVE_2026_48541_Krayin_CSTI_Person_Name
{
    meta:
        description = "Detects Vue.js client-side template injection payloads referencing prototype-chain Function constructor access in Krayin CRM person records"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-48541"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $vue_open  = "{{" ascii wide
        $vue_close = "}}" ascii wide
        $ctor      = "constructor" ascii wide nocase
        $func      = "Function" ascii wide
        $proto1    = "__proto__" ascii wide
        $proto2    = "prototype" ascii wide nocase

    condition:
        filesize < 5MB and
        (
            ($vue_open and $vue_close and ($ctor or $func)) or
            ($vue_open and $vue_close and ($proto1 or $proto2) and $ctor)
        )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-48541 Krayin CRM Stored CSTI - Vue template injection in person name"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"person"; nocase; http.request_body; content:"{{"; within:2000; http.request_body; content:"constructor"; nocase; http.request_body; content:"Function"; nocase; reference:cve,2026-48541; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-48541; classtype:web-application-attack; sid:202648541; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01;)

Elastic Detection

// Detects HTTP requests carrying Vue double-brace template expressions in Krayin person-name submissions.
// Field names assume the Elastic web/HTTP integration; adjust to your data source.
sequence by source.ip with maxspan=5s
  [ network where http.request.method in ("POST", "PUT", "PATCH")
      and http.request.body.text : ("*{{*", "*}}*")
      and http.request.body.text : ("*constructor*", "*Function*") ]

Splunk SPL Query

index=web OR index=proxy
| eval body = coalesce(uri_query, form_data, request_body, "")
| where (match(method, "(?i)POST|PUT|PATCH") OR isnull(method))
| where match(lower(uri), "person|contact")
| where (match(body, "\{\{") AND match(body, "\}\}") AND (match(lower(body), "constructor") OR match(body, "Function")))
| stats count min(_time) as first_seen max(_time) as last_seen values(src) as source_ips values(uri) as uris by user, dest
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="krayin_web,cve_2026_48541,">
  <rule id="202648541" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <description>CVE-2026-48541 - Krayin CRM person-name CSTI attempt (Vue double-brace payload) in HTTP request.</description>
    <match>person</match>
    <regex type="pcre2">(?i)(\{\{.*\}\}).*(constructor|Function)</regex>
    <mitre>
      <id>T1059.007</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected-version package data is available from tracked sources. The guidance below is defensive and does not depend on a released patch.

1) Immediate mitigations (no official patch available):

• Restrict who can create or edit person records. Because exploitation requires authenticated write access (PR:L), reducing the number of accounts able to modify person records narrows the attacker population.
• Run Krayin CRM behind a WAF/reverse proxy and enable input filtering for Vue template metacharacters ({{, }}) and prototype-chain/Function-constructor keywords in request bodies. Treat this as compensating control only; encoded variants can bypass naive filters.
• Enforce strict Content-Security-Policy (disallow unsafe-inline/unsafe-eval, restrict script-src to trusted origins) to reduce the impact of any script that does reach execution, although CSTI that leverages the template compiler itself may still be impacted differently than classic XSS.
• Set session cookies with HttpOnly, Secure, and SameSite to limit session-access impact of same-origin script execution.
• Monitor the detection rules above; hunt existing person records for stored double-brace payloads and remediate any found.

2) Patch / upgrade steps: No patch exists as of this report. Track the Krayin CRM project's release channels for a version above 2.2.6 and apply immediately once available. Because patch confidence is 0/4, do not assume any specific version contains the fix; validate against vendor release notes before relying on it.

3) Long-term hardening:

• Adopt a systematic output-encoding strategy: treat all user-supplied values that may be rendered by the Vue template compiler as untrusted and never pass user data into template compilation. Prefer binding values as data (v-bind/text) rather than interpolating them as template source.
• Introduce CI/CD security gates: SCA and SAST to flag template-compiler sinks and CSTI patterns, plus DAST for stored XSS in CRM forms.
• Apply least privilege to CRM roles; separate record-creation rights from data-viewing rights where operationally feasible.
• Log and review person-record create/update events (who changed what and when) to support detection and incident reconstruction.

References

• NVD — CVE-2026-48541: https://nvd.nist.gov/vuln/detail/CVE-2026-48541
• MITRE ATT&CK — T1059.007 Command and Scripting Interpreter: JavaScript: https://attack.mitre.org/techniques/T1059/007/
• CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): https://cwe.mitre.org/data/definitions/79.html
• FIRST.org EPSS (no score published for this CVE as of this report): https://www.first.org/epss/
• Krayin CRM project (vendor/project release channel for patch tracking): https://krayincrm.com/

Threat-actor note: No exploit-in-the-wild evidence, no public PoC, and no CISA KEV listing exist for CVE-2026-48541 in the provided data. No known campaign is attributed to this vulnerability.