CVE-2026-109612 is a high severity stored cross-site scripting flaw (CVSS 7.3) in Frappe ERPNext. A report view interpolates stored record names into markup without escaping. Fixed in versions 15.120.0 and 16.33.0, so upgrade to the patched release in your line.
What's affected
The record says ERPNext before 15.120.0 and 16.x before 16.33.0 are affected. The GitHub advisory GHSA-f99r-gp2w-xghj, published on 20 September 2026 and rated High at 8.7, lists the package erpnext with affected versions below 15.120.0 and below 16.33.0 and patched versions 15.120.0 and 16.33.0. VulnCheck's advisory, which we fetched, gives the same ranges and a CVSS 4.0 score of 8.5.
Scores differ. The record scores the flaw 7.3 and does not mark a changed scope, while the GitHub advisory shows 8.7 with a changed scope and VulnCheck shows 8.5 under a newer scoring version. All three call it High.
The weakness is CWE-79, improper neutralisation of input during web page generation, or cross-site scripting. The record's vector is network reachable, low complexity, low privileges and user interaction required, with high confidentiality and integrity impact. The component is a report view, and the record does not name which report.
How to check if you're exposed
Find your ERPNext version from the bench directory:
bench version
Compare the erpnext line against the fixed versions: 15.120.0 for version 15 and 16.33.0 for version 16. Run the command on every site and bench you operate, including staging and training instances.
Then assess who can create records. The record says authenticated users able to create such records can give them malicious names, and the script then runs in the session of any user who later opens the affected view. List the roles that can create the record types involved and who holds them. In many companies, that includes external users, portal users and temporary staff.
The advisory says there is no workaround, and that upgrading is required.
What to do now
- Upgrade ERPNext to 15.120.0 or later on version 15, or 16.33.0 or later on version 16, using your normal bench update process.
- Back up the site database before you update, and test the update on a staging copy.
- Review who has permission to create the affected records, and remove the permission from accounts that do not need it.
- Search recent record names for markup characters or script like text and rename or delete anything suspicious.
- If you suspect a record name was crafted, have users who opened the view sign out and consider resetting sessions and API keys for privileged users.
Why it matters
Stored cross-site scripting happens when the application saves text from one user and later writes it into a page for another user without escaping it. The browser cannot tell the difference between the page's own markup and the stored text, so a name that contains script runs as if the site had written it.
The session the script runs in belongs to the person who opens the page. If that person is an administrator, the attacker gains the reach of an administrator inside an ERP that holds orders, invoices, payroll and customer data. This is why the advisory scores the flaw with a changed scope and high confidentiality and integrity impact, even though the attacker starts with a normal account.
The fix is escaping at output. Every place where a stored value is placed into a page needs it, which is why a framework this large can have the same bug in several views, and why this CVE has a close relative fixed in a different release, CVE-2026-109604. The record does not mark either as known exploited.
Quick check
Is there a workaround?
The advisory says no workaround is available and that upgrading is required.
Why are two ERPNext XSS CVEs fixed in different versions?
They concern different views. One is a tool view and one is a report view, and the fixes shipped in different releases, so check both version lines.
Sources
You can also run a free in-browser dependency scan at gold.safeguard.sh/scan to see which of your packages carry known CVEs.
Last reviewed: 18 October 2026.
