CVE-2026-48542

Name of the Vulnerable Software and Affected Versions Krayin CRM versions prior to 2.2.7

Description Authenticated attackers can execute arbitrary JavaScript in the browsers of other users via a stored client-side template injection. By injecting Vue.js template expressions into the product name field, an attacker can use double-brace template syntax to reach the Vue template compiler. This allows for prototype chain traversal to retrieve the Function constructor and execute malicious code within the application origin whenever a user views the affected product record.

Recommendations Update Krayin CRM to version 2.2.7 or later. As a temporary mitigation, restrict the ability of users to modify the product name field.