Frappe ERPNext stored XSS in report view lets authenticated users run script (CVE-2026-109612)

What happened

Frappe ERPNext fails to escape record names when they are interpolated into report views. An authenticated user with the ability to create records can store a crafted record name containing script. When another user opens the report view, the stored script runs in that user's session with that user's access rights.

The flaw is rated high with a CVSS 4.0 score of 8.5. It requires network access, low privileges, and some user interaction: the victim must open the affected report. The CVE record does not state that this vulnerability has been publicly disclosed or exploited in the wild, and CISA's KEV catalogue does not list it.

Who is affected

ERPNext versions before 15.120.0 are affected, as are 16.x releases from 16.0.0-beta.1 to before 16.33.0. The vulnerable component is the report view. The attacker only needs the ability to create records; the victim is any user who opens a report that renders stored record names.

What to do now

1. Upgrade to the fixed release for your branch: ERPNext 15.120.0 or 16.33.0. The CVE record lists these as fixing the flaw.
2. If you cannot apply the patch immediately, restrict who can create records and limit which users can open report views that render stored record names.
3. No workaround has been published; treat the upgrade as the required remediation.

How to detect it

Review record names stored in ERPNext for HTML or script tags, particularly records used in report views. Monitor for unexpected script execution by users who open shared reports.

Beyond the patch

Because the fix is delivered through upstream ERPNext releases, tracking the components you run and their patch cycles is part of exposure management rather than a one-off. Use Supply Chain Defense & Third-Party Risk to track ERPNext and other components, and Implementation & Assessment Services for a penetration test or hardening review of an ERP deployment that exposes report views to users.