CVE-2026-48542

Executive Summary

CVE-2026-48542 is a stored client-side template injection (CSTI) vulnerability in Krayin CRM through version 2.2.6. An authenticated attacker can inject Vue.js double-brace template expressions into the product name field, which are later compiled by the Vue template compiler in the browsers of other users viewing the affected product record, resulting in arbitrary JavaScript execution in the application origin. Because the payload is stored server-side and rendered to other users, the flaw crosses a trust boundary (CVSS scope change is "Changed"), enabling session-impacting XSS against any user who views the poisoned product.

Technical Analysis

The vulnerability resides in how Krayin CRM stores and subsequently renders user-supplied product names. Krayin CRM is a Laravel-based application whose administrative and staff-facing UI is authored with Vue.js. Vue.js performs client-side template compilation on strings that contain its directive/template syntax, notably the double-curly-brace interpolation delimiters {{ ... }}.

When an authenticated user supplies a product name containing Vue template expression syntax, the application persists that string verbatim into the backend datastore. At render time, the stored product name is passed into the Vue template compilation path (rather than being treated strictly as inert text or interpolated as a data value). Because the string is compiled rather than escaped, the expression is evaluated as JavaScript within the Vue rendering context.

The NVD description explicitly states that the mechanism enables "prototype chain traversal to retrieve the Function constructor and execute attacker-supplied JavaScript." This is the canonical CSTI-to-RCE-in-the-browser primitive: a template expression walks the JavaScript prototype chain (for example, reaching Function via the global object reachable from the template's evaluation context) and then invokes that constructor to build and run attacker-controlled JavaScript. Critically, the resulting code executes in the application origin — the same origin as Krayin CRM itself — not in a sandboxed or isolated frame.

Key technical attributes:

• Vulnerability class: Client-side template injection (CSTI), scored under CWE-79 (Improper Neutralization of Input During Web Page Generation / XSS). CSTI is frequently mis-classified as a simple XSS but is materially more powerful because Vue's expression evaluator gives access to the JavaScript object graph, including constructors reachable through the prototype chain.
• Storage and blast radius: The payload is stored, meaning it is not a one-shot reflected payload delivered via a crafted link. Any user who later opens the product record triggers execution. This is what converts a single-user self-XSS-style issue into a cross-user attack.
• Trust boundary: The CVSS vector indicates Scope is Changed (S:C), indicating the exploited component (the rendering/user context) impacts resources beyond its security authority — i.e., victim user contexts distinct from the attacker.
• Privilege/UI profile: PR:L (attacker must be authenticated), UI:R (a victim user must interact by viewing the affected record), AV:N (network-reachable), AC:L (no special conditions).

The specific code path, function names, route, controller, or template file involved in compiling the product name is not disclosed in the NVD description or CNA title. No public advisory enumerates the affected source files. Analysts should treat the render path that handles product names as the area of interest but should not assume particular method or file names.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (stored CSTI), the affected field (product name), and the behavior stated in the NVD description. Specific internal identifiers are intentionally omitted because they are not provided.

1. Reconnaissance / target identification. The attacker first identifies a Krayin CRM instance (through 2.2.6) and obtains a valid low-privileged authenticated session. Because the flaw requires PR:L, the attacker needs at least a legitimate account able to create or modify product records. In a typical deployment, that is a staff or back-office account.

2. Triggering the flaw class (storage). Using the authenticated session, the attacker creates or edits a product and supplies a name value that contains Vue.js double-brace template expression syntax. The string is accepted and stored by the application without neutralizing the Vue template delimiters. At this point the poisoned record exists in the datastore and is retrievable by other users.

3. Payload / execution method (vulnerability-class level). When any user views the affected product record, the stored name is fed to the Vue template compiler. Vue evaluates the expression inside the double-brace delimiters. Per the NVD description, the expression traverses the JavaScript prototype chain to obtain the Function constructor and invokes it with attacker-supplied JavaScript. The resulting code runs in the Krayin CRM application origin. The exact payload expression is not published and is not reproduced here; the operative mechanism is prototype-chain traversal to the Function constructor within a compiled Vue expression.

4. Post-exploitation impact. Because execution occurs in the application origin for every user who views the record, the attacker can act with the victim's authenticated context — for example, performing actions the victim is authorized to perform, reading data rendered to that user, or exfiltrating it to an attacker-controlled endpoint. The CVSS subscores bound the modeled impact as Low confidentiality (C:L) and Low integrity (I:L) with no modeled availability impact (A:N), reflecting that the primary demonstrated impact is client-side execution in victim contexts rather than server compromise.

Note: no exploit code, PoC, or Nuclei template is known for this CVE at the time of writing.

Impact Assessment

Successful exploitation yields arbitrary JavaScript execution in the origin of the Krayin CRM application, for each user who views an affected product record. The practical consequences track the victim's privileges: an administrative viewer yields the broadest blast radius because the malicious script inherits the admin session's reachable operations in the CRM UI.

CVSS 3.1 assessment: 5.4 (Medium) — AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.

• AV:N / AC:L: reachable over the network with no unusual conditions.
• PR:L: requires an authenticated account — not anonymous.
• UI:R: a victim must view the poisoned product record; the payload is not self-triggering on page load without interaction.
• S:C: impact crosses the security boundary into other users' browser contexts, which is why stored CSTI is scored with scope change despite Low CIA subscores.
• C:L / I:L / A:N: the modeled impact on the victim context is limited but non-trivial; no availability impact is modeled.

Affected systems: self-hosted Krayin CRM deployments running version 2.2.6 or earlier. The exact lower bound of the vulnerable range is not enumerated in available data; assume all releases up to and including 2.2.6 are affected.

Blast radius: every authenticated user who views the poisoned product record, up to and including administrators. Because execution is same-origin, output capture, reflected content, and CSRF-relevant actions reachable from the victim's session are theoretically in scope, bounded by the Low CIA scoring.

Detection Guidance

Sigma Rule

title: Krayin CRM Stored Client-Side Template Injection in Product Name
id: 3f1a9c2e-7b64-4d1e-9a02-krayin48542
status: experimental
description: Detects submission of product data containing Vue.js template
  expression syntax (double curly braces) that may indicate exploitation of
  stored CSTI CVE-2026-48542 in Krayin CRM <= 2.2.6.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-48542
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
  product: generic
detection:
  selection_method:
    cs-method:
      - 'POST'
      - 'PUT'
      - 'PATCH'
  selection_path:
    cs-uri-stem|contains:
      - '/admin/products'
      - '/products'
  selection_payload:
    cs-uri-query|contains:
      - '{{'
      - 'constructor'
      - 'Function('
  condition: selection_method and selection_path and selection_payload
falsepositives:
  - Legitimate product descriptions containing literal template syntax
  - Documentation or marketing content referencing JavaScript code samples
level: medium
tags:
  - attack.t1059.007
  - cve.2026-48542
  - cwe.79

YARA Rule

rule CVE_2026_48542_Krayin_Vue_CSTI
{
    meta:
        description = "Detects Vue.js client-side template injection payloads targeting Krayin CRM CVE-2026-48542"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-48542"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $vue_brace = "{{" ascii wide
        $vue_brace2 = "}}" ascii wide
        $constructor = "constructor" ascii nocase
        $function_ctor = "Function(" ascii nocase
        $ctr_ctor = "constructor.constructor" ascii nocase

    condition:
        $vue_brace and $vue_brace2 and (
            $constructor or $function_ctor or $ctr_ctor
        )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-48542 Krayin CRM Vue.js CSTI Payload in Product Submission"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/products"; nocase; http.request_body; content:"{{"; http.request_body; content:"constructor"; nocase; http.request_body; content:"Function("; nocase; classtype:web-application-attack; reference:cve,2026-48542; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-48542; sid:90048542; rev:1;)

Elastic Detection

sequence by user.name, source.ip with maxspan=5m
  [http where http.request.method in ("POST", "PUT", "PATCH")
     and http.request.uri like "*/products*"]
  [http where http.request.method in ("POST", "PUT", "PATCH")
     and http.request.body.text like "*{{*constructor*"
     and http.request.body.text like "*Function(*"]

Splunk SPL Query

index=web sourcetype="access_combined" OR sourcetype="krayin:*"
| eval body=coalesce(request_body, form_data, cs_uri_query)
| where match(body, "\{\{")
| where match(lower(body), "constructor") OR match(lower(body), "function\(")
| search (uri_path="*products*" OR cs_uri_stem="*products*")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, user, uri_path, cs_method
| where count >= 1
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="krayin,cve-2026-48542,web,">
  <rule id="10048542" level="10">
    <if_sid>31100</if_sid>
    <id>^4[0-9]{2}$</id>
    <description>CVE-2026-48542: Possible Krayin CRM stored Vue.js template injection attempt (payload with double-brace template syntax)</description>
    <match>products</match>
    <regex type="pcre2">(?i)\{\{.*(constructor|function\s*\()</regex>
    <group>web_attack,sql_injection,</group>
    <mitre>
      <id>T1059.007</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED) — no patch evidence from any tracked source. No vendor fix or workaround has been published.

1) Immediate mitigations (no vendor patch available):

• Restrict the ability to create or edit product records to the smallest possible set of trusted accounts. Since the flaw requires an authenticated account (PR:L), reducing who can author product data directly shrinks the attack surface.
• Where feasible, treat product name content as untrusted: sanitize outbound rendering of stored product names rather than trusting the frontend to compile them as templates. If the deployment allows code changes, ensure product names are interpolated as data values ({{ productName }}) or rendered as plain text rather than being passed to the Vue template compiler. This is a code-level remediation the application owner must implement.
• Consider temporarily stripping or rejecting double-curly-brace sequences and prototype-chain keywords (constructor, Function() from product name input as a compensating control.
• Monitor for unexpected Vue template syntax in stored product data and alert on it.

2) Patch/upgrade steps:

• No fixed version is identified. Monitor the Krayin CRM release channel and the NVD entry for CVE-2026-48542 for a vendor-maintained fixed release. When a patched version is published, upgrade immediately and verify that the render path treats stored product names as inert data.
• Track the vendor repository/security advisories for a fix reference for version 2.2.6 and later.

3) Long-term hardening:

• Adopt a general policy against compiling untrusted, user-authored strings through client-side template engines (Vue, Angular, etc.). Where dynamic rendering is required, use data binding rather than expression compilation.
• Apply Content Security Policy to reduce the reach of any successful JavaScript execution in the application origin.
• Add output encoding at all render sinks that display stored, user-supplied fields.
• Train back-office users that viewing unfamiliar product records in a compromised instance can trigger client-side code execution in their own session.
• Run periodic dependency and CMS advisory reviews given the absence of coordinated disclosure for this issue.

References

• NVD — CVE-2026-48542: https://nvd.nist.gov/vuln/detail/CVE-2026-48542
• Krayin CRM project site / release notes (monitor for fixed release): https://krayincrm.com
• MITRE ATT&CK — T1059.007 Command and Scripting Interpreter: JavaScript: https://attack.mitre.org/techniques/T1059/007/
• MITRE CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): https://cwe.mitre.org/data/definitions/79.html
• OWASP — Client-Side Template Injection (CSTI) guidance: https://owasp.org/www-project-web-security-testing-guide/

Campaign / exploit-in-the-wild status: No public PoC, Nuclei template, or exploit code is known. CISA KEV does not list this CVE. No threat actor campaigns are associated with CVE-2026-48542 in available data. EPSS has not yet been scored by FIRST.org at the time of writing.