Is CVE-2026-109673 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-109673?

CVE-2026-109673 has a CVSS v3 severity of HIGH (7.3).

Back

CVE-2026-109673

Description

Frappe ERPNext before 15.103.0 and 16.x before 16.12.0 contains a stored cross-site scripting vulnerability because the names of certain records are not properly neutralized when rendered on some dashboards, tools, and portals. Authenticated attackers can craft malicious record names that execute scripts in other users' browsers, enabling data access, modification, and token theft, especially against privileged users.