CVE-2026-53575

Name of the Vulnerable Software and Affected Versions EspoCRM versions prior to 9.3.9

Description An authenticated administrator can perform a CSP nonce injection via the applicationName setting. This allows the insertion of persistent, unescaped content into the main application page, enabling the execution of attacker-controlled JavaScript within user sessions. This can lead to the leakage of page data, including unsaved user input. CSP (Content Security Policy) nonce injection is a technique used to bypass security policies that restrict which scripts can execute on a page.

Recommendations Update to version 9.3.9.