Frappe ERPNext reflected cross-site scripting allows account takeover (CVE-2025-71432)

What happened

Frappe ERPNext contains a reflected cross-site scripting vulnerability. A page does not validate input, so an attacker can prepare a URL that, when opened by a logged-in ERPNext user, executes arbitrary JavaScript in that user's authenticated session. Because the script runs with the victim's permissions, the attacker can take over the account.

The flaw is rated high with a CVSS 4.0 score of 8.6. It is reachable over the network with no privileges required to launch the attack, but it does require the victim to open a crafted link. Frappe's GitHub advisory and the VulnCheck advisory do not report active exploitation.

Who is affected

ERPNext is affected in the following release lines: all versions before 14.92.1, and 15.0.0 to before 15.83.0. ERPNext is an open-source enterprise resource planning application used to run business workflows, and it is commonly exposed through a web interface to staff and sometimes to external parties. If you run an unpatched 14.x or 15.x build, you are in the affected range. Fixed versions are ERPNext 14.92.1 and ERPNext 15.83.0.

What to do now

1. Apply the fixed release. Upgrade 14.x deployments to ERPNext 14.92.1 and 15.x deployments to ERPNext 15.83.0.
2. If you cannot patch immediately, reduce access to the ERPNext web interface, for example by allowing only trusted internal networks through a VPN or restricting external access.
3. Tell users to treat unexpected ERPNext links with caution, especially links that prompt them to sign in, approve an action, or review a document.
4. If a user reports opening a suspicious link, review their account and any high-privilege actions taken during that session.

Frappe has not published a workaround for this vulnerability.

Beyond the patch

ERPNext deployments that are reachable outside the office, or used by suppliers through a portal, are the kind of target this link-based takeover relies on. Virtual CISO Services (vCISO) helps map internet-exposed ERPNext services and reduce that exposure before the next vulnerability appears. Supply Chain Defense & Third-Party Risk helps track the ERPNext versions you run and how quickly fixes such as 14.92.1 and 15.83.0 move through your change process.