CVE-2026-38432
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
ERPNext version 15.103.1 and earlier is vulnerable to Cross-Site Scripting (XSS) in the Email Template engine. An attacker with permission to create or edit email templates can inject malicious JavaScript code that executes in the victim's browser when the template is applied.
Risk Assessment
An attacker can steal session data or perform other harmful actions in the victim's context, potentially leading to data confidentiality breaches.
Recommendation
Update ERPNext to a version later than 15.103.1 that includes the XSS fix.
Original NVD description (English source)
ERPNext v15.103.1 and before is vulnerable to Cross Site Scripting (XSS) in the Email Template engine. An attacker with permission to create or edit email templates can inject malicious JavaScript code that are executed on the victim's browser when the template is applied.