Executive brief
ERPNext is an open-source enterprise resource planning system used by businesses to manage operations like sales and inventory. A security vulnerability allows an authorized user with permission to edit item records to plant malicious code within item names or descriptions. When a checkout operator adds one of these items to a sale in the Point of Sale (POS) interface, the malicious code executes in their browser, potentially allowing the attacker to steal session information or perform unauthorized actions on behalf of the operator.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in ERPNext version 16.16.0. The vulnerability is located in the Point of Sale (POS) cart interface, which fails to properly escape or neutralize input from the 'item_name', 'description', or 'image' fields of an Item record. An attacker with high-privilege access (specifically, permissions to edit Item records) can inject arbitrary HTML or JavaScript into these fields. When a POS operator subsequently adds the compromised item to a transaction, the payload is rendered unescaped in their browser. This allows for the execution of malicious scripts in the context of the operator's session.
Affected products
- Frappe ERPNext 16.16.0
Timeline
- 2026-06-03: disclosed: Advisory published by Fluid Attacks and NVD.