Cross-site scripting in ERPNext - #VU163065
Published: November 9, 2026
Vulnerability identifier: #VU163065
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: N/A
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an authenticated attacker with the Sales User role to execute scripts in another user's session and act with that user's permissions.
The vulnerability exists due to missing HTML sanitization when saving notes on Leads and Opportunities in ERPNext's CRM module. An authenticated attacker with the Sales User role can save a crafted note whose payload executes when another user opens the record.
Affected software
ERPNext
Remediation
Install security update from vendor's website.
ERPNext - addressed in versions 15.124.0, 16.52.0