Improper Neutralization of Special Elements Used in a Template Engine in ERPNext - CVE-2026-109652
Published: August 13, 2026 / Updated: October 16, 2026
Vulnerability identifier: #VU142378
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-109652
CWE-ID: CWE-1336
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to improper neutralization of special elements used in a template engine in user-controlled message fields when processing user-supplied message content. A remote user can inject crafted template expressions to execute arbitrary code.
Exploitation gives access to an unrestricted template context, which can enable arbitrary database reads and writes, document deletion, outbound requests from the server, and mail sent by the site.
Affected software
ERPNext
How to mitigate CVE-2026-109652
Install security update from vendor's website.
ERPNext - addressed in versions 15.119.1, 16.32.0