CVE-2026-109653

Name of the Vulnerable Software and Affected Versions Frappe ERPNext versions prior to 15.119.0 Frappe ERPNext versions 16.x prior to 16.31.0

Description A stored cross-site scripting issue exists because record fields are rendered into an HTML attribute context without proper escaping. This allows a low-privilege user to store a malicious payload in a record field, which then executes in the browser of any privileged user who views the affected page, potentially leading to account takeover.

Recommendations Update to version 15.119.0 or later. Update to version 16.31.0 or later.