ERPNext stored XSS lets authenticated users execute scripts via tool view record names (CVE-2026-109604)

What happened

ERPNext interpolates stored record names into tool-view markup without escaping them. Because record names are attacker-controlled, an authenticated user with the ability to create these records can set a record name containing script or HTML. When another user later opens the affected tool view, that content is rendered as markup and the script runs in the victim's ERPNext session, with the victim's access to data and actions.

The attack requires a valid ERPNext account with the ability to create the relevant records, and the victim must open the affected tool view. The flaw is reachable over the network. The CVE record does not report exploitation in the wild, the flaw is not listed in CISA's KEV, and no public disclosure is recorded.

Who is affected

ERPNext versions before 15.112.0 are affected. The 16.x line is affected from 16.0.0-beta.1 up to versions before 16.23.0. ERPNext is an open-source ERP platform; affected instances are those where an authenticated user can create records whose names appear in a tool view.

What to do now

1. Upgrade ERPNext to 15.112.0, or to 16.23.0 for deployments on the 16.x line. These are the fixed versions listed in the advisory.
2. No vendor workaround is listed in the advisory references. Until patching is complete, restrict ERPNext access to trusted users and limit who can create records whose names appear in tool views.
3. Review existing record names in tool views for HTML or script content, particularly those created by low-privileged accounts.

How to detect it

The advisory references do not provide indicators of compromise. As a precaution, review ERPNext tool views for record names containing HTML or script, particularly records created by low-privileged users, and investigate unexpected script execution or unexpected actions in user sessions.

Beyond the patch

This is the kind of flaw that turns a low-privileged account into a wider compromise once someone with more access opens the wrong view, so patching is only the first step. Use Supply Chain Defense & Third-Party Risk to keep an inventory of ERPNext and other open-source components you run and to track how quickly their maintainers publish fixes; the patch cadence of the tools your business depends on is part of your exposure window.