Executive brief
ERPNext, a popular open-source enterprise resource planning (ERP) suite, contains a security flaw in its email template system. An attacker with the ability to create or edit email templates can embed malicious scripts that trigger when another user applies that template. This could allow an attacker to hijack user sessions, steal sensitive business data, or perform unauthorized actions on behalf of other employees.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in ERPNext versions up to and including 15.103.1. The flaw is located in the Email Template engine, specifically when the 'Use HTML' option is enabled for a template. An attacker with permissions to create or modify email templates can inject a malicious payload (e.g., using an 'onerror' attribute in an 'img' tag) into the message body. When a victim selects and applies the compromised template while composing a new email, the injected JavaScript executes in their browser session. This can lead to session hijacking or unauthorized data access within the Frappe/ERPNext 'Desk' interface.
Affected products
- Frappe ERPNext <= 15.103.1
Timeline
- 2026-04-03: disclosed: Initial researcher disclosure published
- 2026-05-05: advisory: CVE-2026-38432 published