ERPNext 16.16.0 Stored XSS in POS Cart via Item Description/Image

ERPNext 16.16.0 – Stored XSS in POS cart item rendering Vulnerability Overview A stored Cross-Site Scripting (XSS) vulnerability exists in the POS (Point of Sale) cart item rendering in ERPNext version 16.16.0. Attackers can inject malicious HTML/JavaScript code into the product name, description, or image fields to trigger unescaped rendering, thereby executing malicious scripts in the POS operator interface. Affected Scope Affected Product: ERPNext Affected Versions: 16.16.0 Vulnerability Type: Stored Cross-Site Scripting (XSS) CVSS v4.0 Base Score: 4.8 CVSS v4.0 Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:R/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N CVE ID: CVE-2026-42839 Remediation No patch is currently available. Users are advised to wait for an official fix and implement the following temporary measures until the fix is released: 1. Restrict access to the ERPNext system to authorized users only. 2. Implement strict validation and filtering of input data to prevent malicious code injection. 3. Regularly update and monitor systems to ensure timely detection and response to potential security threats. POC Code Via Item Record Fields (User with Item Editing Permissions) 1. Log in to ERPNext as a user with the Item Manager or Stock Manager role. 2. Navigate to Stock → Items → → Edit (or create a new item). 3. Set the Description field to a payload that does not contain (to bypass guard conditions): 4. Save the item. 5. Confirm that the payload is stored as-is: 6. Open the POS interface as a POS Operator (different user/session): Navigate to Point of Sale → Open any POS session → Add the malicious item to the cart. Alternative Path via Image Attribute Injection Set the item's image field to: When the item is added to the cart, renders: The first attribute is overwritten, or both are triggered depending on browser behavior, causing the injected handler to execute.

Goal Reached Thanks to every supporter — we hit 100%!

ERPNext 16.16.0 Stored XSS in POS Cart via Item Description/Image

More from this source