Executive brief
ERPNext is an open-source enterprise resource planning system used by businesses to manage operations like sales and inventory. A security flaw allows a logged-in user to inject malicious code into customer contact fields. When a store operator later views that customer in the Point of Sale (POS) interface, the code executes in their browser, potentially allowing the attacker to steal session information or perform unauthorized actions on behalf of the operator.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in ERPNext version 16.16.0. The flaw is located in the Point of Sale (POS) interface, where the 'email_id' and 'mobile_no' fields of a Customer record are rendered using unescaped template literals. An authenticated attacker can input malicious JavaScript into these fields. When a POS operator selects the compromised customer record, the payload executes in the context of the operator's session. This can lead to session hijacking or unauthorized data access within the ERP system.
Affected products
- Frappe ERPNext 16.16.0
Timeline
- 2026-06-03: disclosed: Vulnerability published by Fluid Attacks
- 2026-06-03: advisory: CVE-2026-42840 published to NVD