CVE-2026-48543

Name of the Vulnerable Software and Affected Versions Krayin CRM versions prior to 2.2.7

Description Authenticated attackers can execute arbitrary JavaScript in the browsers of other users via a stored client-side template injection. By injecting Vue.js template expressions into the web form description field, an attacker can use double-brace template syntax to reach the Vue template compiler. This allows for prototype chain traversal to retrieve the Function constructor and execute malicious code within the application origin for any user viewing the affected web form.

Recommendations Update Krayin CRM to version 2.2.7 or later.