Description
Frappe ERPNext 16.x before 16.27.0 contains a stored cross-site scripting vulnerability that allows users with edit rights to inject script through a record name rendered without escaping. Attackers can set a malicious record name so the script runs in the browser of any colleague who opens the page.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| frappe | erpnext | 16.0.0-beta.1 – < 16.27.0 | 16.27.0 |
References
- GitHub Security Advisory (GHSA-mvr5-2j8r-53p4) vendor-advisory
- VulnCheck Advisory: Frappe ERPNext 16.x before 16.27.0 Stored XSS via Unescaped Record Name third-party-advisory